sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-24 13:57:43 +03:00
Code

dsdb: Correctly handle memory in objectclass_attrs

Browse Source 
el->values is caller-provided memory that should be thought of as constant,
it should not be assumed to be a talloc context.

Otherwise, if the caller gives constant memory or a stack
pointer we will get an abort() in talloc when it expects
a talloc magic in the memory preceeding the el->values.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14258

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Andrew Bartlett 2020-01-30 16:41:39 +13:00 committed by Stefan Metzmacher
parent d3b385d596
commit 3657bbc211
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
source4/dsdb/samdb/ldb_modules/objectclass_attrs.c
View File

@ -133,7 +133,16 @@ static int oc_auto_normalise(struct ldb_context *ldb, const struct dsdb_attribut
for (i=0; i<el->num_values; i++) {
struct ldb_val v;
int ret;
ret = attr->ldb_schema_attribute->syntax->canonicalise_fn(ldb, el->values, &el->values[i], &v);
/*
* We use msg->elements (owned by this module due to
* ldb_msg_copy_shallow()) as a memory context and
* then steal from there to the right spot if we don't
* free it.
*/
ret = attr->ldb_schema_attribute->syntax->canonicalise_fn(ldb,
msg->elements,
&el->values[i],
&v);
if (ret != LDB_SUCCESS) {
return ret;
}
@ -156,6 +165,12 @@ static int oc_auto_normalise(struct ldb_context *ldb, const struct dsdb_attribut
}
el->values[i] = v;
/*
* By now el->values is a talloc pointer under
* msg->elements and may now be used
*/
talloc_steal(el->values, v.data);
}
return LDB_SUCCESS;
}