From aebf88cc3f73574112a41b4aeaa6745bf735816a Mon Sep 17 00:00:00 2001
From: Martin Schwenke <mschwenke@ddn.com>
Date: Sat, 30 May 2026 17:35:23 +1000
Subject: [PATCH 07/23] CVE-2026-58224: ctdb-daemon: Avoid out of bounds data access

The count can't exceed the recdata buffer size.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16085

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 ctdb/server/ctdb_update_record.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/ctdb/server/ctdb_update_record.c b/ctdb/server/ctdb_update_record.c
index 405499c81e2..154b1427410 100644
--- a/ctdb/server/ctdb_update_record.c
+++ b/ctdb/server/ctdb_update_record.c
@@ -318,6 +318,16 @@ int32_t ctdb_control_update_record(struct ctdb_context *ctdb,
 	struct childwrite_handle *handle;
 	struct ctdb_marshall_buffer *m = (struct ctdb_marshall_buffer *)recdata.dptr;
 
+	if (recdata.dsize < offsetof(struct ctdb_marshall_buffer, data)) {
+		DBG_ERR("Invalid packet\n");
+		return -1;
+	}
+	if (m->count >
+	    recdata.dsize - offsetof(struct ctdb_marshall_buffer, data)) {
+		DBG_ERR("Invalid packet\n");
+		return -1;
+	}
+
 	if (ctdb->recovery_mode != CTDB_RECOVERY_NORMAL) {
 		DEBUG(DEBUG_INFO,("rejecting ctdb_control_update_record when recovery active\n"));
 		return -1;
-- 
2.43.0


