From bbf7f1c64c31f50a4fceafee40315c2a6605e30d Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Tue, 9 Jun 2026 21:48:02 +1000
Subject: [PATCH 11/23] CVE-2026-58224: ctdb-protocol: Avoid off-by-one error for bytes pulled

As per the comment, if there is no NUL byte in the buffer then don't
count one in the number of bytes pulled.

Note that this is unlikely to be a security issue because it would
take a protocol bug elsewhere to overrun the buffer.  However, include
this fix here for posterity.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Reported-by: Andrew Tridgell (issue 16)
Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/protocol/protocol_basic.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/ctdb/protocol/protocol_basic.c b/ctdb/protocol/protocol_basic.c
index 42f207790d0..9cc52def644 100644
--- a/ctdb/protocol/protocol_basic.c
+++ b/ctdb/protocol/protocol_basic.c
@@ -247,7 +247,8 @@ void ctdb_string_push(const char **in, uint8_t *buf, size_t *npush)
 int ctdb_string_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
 		     const char **out, size_t *npull)
 {
-	const char *str;
+	const char *str = NULL;
+	size_t len = 0;
 
 	if (buflen > UINT32_MAX) {
 		return EMSGSIZE;
@@ -265,7 +266,14 @@ int ctdb_string_pull(uint8_t *buf, size_t buflen, TALLOC_CTX *mem_ctx,
 	}
 
 	*out = str;
-	*npull = ctdb_string_len(&str);
+	/*
+	 * Avoid claiming to have consumed more than buflen.
+	 * ctdb_string_len() returns buflen + 1 if there is no
+	 * NUL-terminator within buflen, so no NUL was actually
+	 * consumed (so no +1 needed).
+	 */
+	len = ctdb_string_len(&str);
+	*npull = MIN(buflen, len);
 	return 0;
 }
 
-- 
2.43.0


