Projects
openEuler:20.03:LTS:SP3
samba
_service:tar_scm_kernel_repo:backport-006-CVE-2...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm_kernel_repo:backport-006-CVE-2021-3670.patch of Package samba
From 3a4eb50cf74671de3442d179bd2d44afd5bc52c1 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett <abartlet@samba.org> Date: Thu, 18 Nov 2021 15:57:34 +1300 Subject: [PATCH] CVE-2021-3670 dsdb/anr: Do a copy of the potentially anr query before starting to modify it RN: Do not modify the caller-supplied memory in the anr=* handling to allow clear logging of the actual caller request after it has been processed. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> (cherry picked from commit 5f0590362c5c0c5ee20503a67467f9be2d50e73b) --- source4/dsdb/samdb/ldb_modules/anr.c | 73 +++++++++++++++++++++++++--- 1 file changed, 65 insertions(+), 8 deletions(-) diff --git a/source4/dsdb/samdb/ldb_modules/anr.c b/source4/dsdb/samdb/ldb_modules/anr.c index 660ba2714962..e083f5db17d8 100644 --- a/source4/dsdb/samdb/ldb_modules/anr.c +++ b/source4/dsdb/samdb/ldb_modules/anr.c @@ -148,8 +148,6 @@ static int anr_replace_value(struct anr_context *ac, return LDB_ERR_OPERATIONS_ERROR; } - ac->found_anr = true; - if (match->length > 1 && match->data[0] == '=') { struct ldb_val *match2 = talloc(mem_ctx, struct ldb_val); if (match2 == NULL){ @@ -285,6 +283,49 @@ static int anr_replace_subtrees(struct anr_context *ac, return LDB_SUCCESS; } +struct anr_present_ctx { + bool found_anr; + const char *attr; +}; + +/* + callback to determine if ANR is in use at all + */ +static int parse_tree_anr_present(struct ldb_parse_tree *tree, void *private_context) +{ + struct anr_present_ctx *ctx = private_context; + switch (tree->operation) { + case LDB_OP_EQUALITY: + case LDB_OP_GREATER: + case LDB_OP_LESS: + case LDB_OP_APPROX: + if (ldb_attr_cmp(tree->u.equality.attr, ctx->attr) == 0) { + ctx->found_anr = true; + } + break; + case LDB_OP_SUBSTRING: + if (ldb_attr_cmp(tree->u.substring.attr, ctx->attr) == 0) { + ctx->found_anr = true; + } + break; + case LDB_OP_PRESENT: + if (ldb_attr_cmp(tree->u.present.attr, ctx->attr) == 0) { + ctx->found_anr = true; + } + break; + case LDB_OP_EXTENDED: + if (tree->u.extended.attr && + ldb_attr_cmp(tree->u.extended.attr, ctx->attr) == 0) { + ctx->found_anr = true; + } + break; + default: + break; + } + return LDB_SUCCESS; +} + + static int anr_search_callback(struct ldb_request *req, struct ldb_reply *ares) { struct anr_context *ac; @@ -322,8 +363,21 @@ static int anr_search(struct ldb_module *module, struct ldb_request *req) struct ldb_parse_tree *anr_tree; struct ldb_request *down_req; struct anr_context *ac; + struct anr_present_ctx ctx; + const char *attr = "anr"; int ret; + ctx.found_anr = false; + ctx.attr = attr; + + ldb_parse_tree_walk(req->op.search.tree, + parse_tree_anr_present, + &ctx); + + if (!ctx.found_anr) { + return ldb_next_request(module, req); + } + ldb = ldb_module_get_ctx(module); ac = talloc(req, struct anr_context); @@ -333,20 +387,23 @@ static int anr_search(struct ldb_module *module, struct ldb_request *req) ac->module = module; ac->req = req; - ac->found_anr = false; #if 0 printf("oldanr : %s\n", ldb_filter_from_tree (0, req->op.search.tree)); #endif - ret = anr_replace_subtrees(ac, req->op.search.tree, "anr", &anr_tree); - if (ret != LDB_SUCCESS) { + /* First make a copy, so we don't overwrite caller memory */ + + anr_tree = ldb_parse_tree_copy_shallow(ac, req->op.search.tree); + + if (anr_tree == NULL) { return ldb_operr(ldb); } - if (!ac->found_anr) { - talloc_free(ac); - return ldb_next_request(module, req); + /* Now expand 'anr' out */ + ret = anr_replace_subtrees(ac, anr_tree, attr, &anr_tree); + if (ret != LDB_SUCCESS) { + return ldb_operr(ldb); } ret = ldb_build_search_req_ex(&down_req,
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.