sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

CVE-2021-3670 dsdb/anr: Do a copy of the potentially anr query before starting to modify it

Browse Source 
RN: Do not modify the caller-supplied memory in the anr=* handling to
allow clear logging of the actual caller request after it has been processed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 5f0590362c5c0c5ee20503a67467f9be2d50e73b)
This commit is contained in:
Andrew Bartlett 2021-11-18 15:57:34 +13:00 committed by Jule Anger
parent d92dfb0dab
commit 3a4eb50cf7
1 changed files with 65 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
source4/dsdb/samdb/ldb_modules/anr.c
View File

@ -148,8 +148,6 @@ static int anr_replace_value(struct anr_context *ac,
return LDB_ERR_OPERATIONS_ERROR;
}
ac->found_anr = true;
if (match->length > 1 && match->data[0] == '=') {
struct ldb_val *match2 = talloc(mem_ctx, struct ldb_val);
if (match2 == NULL){
@ -285,6 +283,49 @@ static int anr_replace_subtrees(struct anr_context *ac,
return LDB_SUCCESS;
}
struct anr_present_ctx {
bool found_anr;
const char *attr;
};
/*
callback to determine if ANR is in use at all
*/
static int parse_tree_anr_present(struct ldb_parse_tree *tree, void *private_context)
{
struct anr_present_ctx *ctx = private_context;
switch (tree->operation) {
case LDB_OP_EQUALITY:
case LDB_OP_GREATER:
case LDB_OP_LESS:
case LDB_OP_APPROX:
if (ldb_attr_cmp(tree->u.equality.attr, ctx->attr) == 0) {
ctx->found_anr = true;
}
break;
case LDB_OP_SUBSTRING:
if (ldb_attr_cmp(tree->u.substring.attr, ctx->attr) == 0) {
ctx->found_anr = true;
}
break;
case LDB_OP_PRESENT:
if (ldb_attr_cmp(tree->u.present.attr, ctx->attr) == 0) {
ctx->found_anr = true;
}
break;
case LDB_OP_EXTENDED:
if (tree->u.extended.attr &&
ldb_attr_cmp(tree->u.extended.attr, ctx->attr) == 0) {
ctx->found_anr = true;
}
break;
default:
break;
}
return LDB_SUCCESS;
}
static int anr_search_callback(struct ldb_request *req, struct ldb_reply *ares)
{
struct anr_context *ac;
@ -322,8 +363,21 @@ static int anr_search(struct ldb_module *module, struct ldb_request *req)
struct ldb_parse_tree *anr_tree;
struct ldb_request *down_req;
struct anr_context *ac;
struct anr_present_ctx ctx;
const char *attr = "anr";
int ret;
ctx.found_anr = false;
ctx.attr = attr;
ldb_parse_tree_walk(req->op.search.tree,
parse_tree_anr_present,
&ctx);
if (!ctx.found_anr) {
return ldb_next_request(module, req);
}
ldb = ldb_module_get_ctx(module);
ac = talloc(req, struct anr_context);
@ -333,20 +387,23 @@ static int anr_search(struct ldb_module *module, struct ldb_request *req)
ac->module = module;
ac->req = req;
ac->found_anr = false;
#if 0
printf("oldanr : %s\n", ldb_filter_from_tree (0, req->op.search.tree));
#endif
ret = anr_replace_subtrees(ac, req->op.search.tree, "anr", &anr_tree);
if (ret != LDB_SUCCESS) {
/* First make a copy, so we don't overwrite caller memory */
anr_tree = ldb_parse_tree_copy_shallow(ac, req->op.search.tree);
if (anr_tree == NULL) {
return ldb_operr(ldb);
}
if (!ac->found_anr) {
talloc_free(ac);
return ldb_next_request(module, req);
/* Now expand 'anr' out */
ret = anr_replace_subtrees(ac, anr_tree, attr, &anr_tree);
if (ret != LDB_SUCCESS) {
return ldb_operr(ldb);
}
ret = ldb_build_search_req_ex(&down_req,