sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-01 04:58:35 +03:00
Code

CVE-2019-3824 ldb: Extra comments to clarify no pointer wrap in wildcard processing

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Andrew Bartlett 2019-02-04 11:22:34 +13:00 committed by Stefan Metzmacher
parent bd62896ddc
commit 28193ca851
1 changed files with 23 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
lib/ldb/common/ldb_match.c
View File

@ -306,12 +306,33 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
p = memmem((const void *)val.data,val.length,
(const void *)cnk.data, cnk.length);
if (p == NULL) goto mismatch;
/*
* At this point we know cnk.length <= val.length as
* otherwise there could be no match
*/
if ( (! tree->u.substring.chunks[c + 1]) && (! tree->u.substring.end_with_wildcard) ) {
uint8_t *g;
uint8_t *end = val.data + val.length;
do { /* greedy */
g = memmem(p + cnk.length,
end - (p + cnk.length),
/*
* haystack is a valid pointer in val
* because the memmem() can only
* succeed if the needle (cnk.length)
* is <= haystacklen
*
* p will be a pointer at least
* cnk.length from the end of haystack
*/
uint8_t *haystack
= p + cnk.length;
size_t haystacklen
= end - (haystack);
g = memmem(haystack,
haystacklen,
(const uint8_t *)cnk.data,
cnk.length);
if (g) p = g;