sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-06 13:18:07 +03:00
Code

CVE-2022-32746 s4/dsdb/acl: Fix LDB flags comparison

Browse Source 
LDB_FLAG_MOD_* values are not actually flags, and the previous
comparison was equivalent to

(el->flags & LDB_FLAG_MOD_MASK) == 0

which is only true if none of the LDB_FLAG_MOD_* values are set, so we
would not successfully return if the element was a DELETE. Correct the
expression to what it was intended to be.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
This commit is contained in:
Joseph Sutton 2022-06-21 15:22:47 +12:00 committed by Jule Anger
parent 582ac17136
commit 0526d27e9e
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/acl-spn-delete
View File

@ -1 +0,0 @@
^samba4.ldap.acl.python.*__main__.AclSPNTests.test_delete_disallowed_spn\(

5
source4/dsdb/samdb/ldb_modules/acl.c
View File

@ -734,8 +734,9 @@ static int acl_check_spn(TALLOC_CTX *mem_ctx,
* If not add or replace (eg delete),
* return success
*/
if ((el->flags
& (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE)) == 0) {
if (LDB_FLAG_MOD_TYPE(el->flags) != LDB_FLAG_MOD_ADD &&
LDB_FLAG_MOD_TYPE(el->flags) != LDB_FLAG_MOD_REPLACE)
{
talloc_free(tmp_ctx);
return LDB_SUCCESS;
}