sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-11 16:58:40 +03:00
Code

pyldb: Avoid use-after-free in msg_diff()

Browse Source 
Make a deep copy of the message elements in msg_diff() so that if either
of the input messages are deallocated early, the result does not refer
to non-existing elements.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14642
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14836

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

[abartlet@samba.org backported from commit
 19a2af02f57d99db8ed3c6b028c3abdf4b553700 due to conflicts in
 the knownfail.d/python-segfaults file]

Autobuild-User(v4-14-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-14-test): Wed Sep 29 13:14:22 UTC 2021 on sn-devel-184
This commit is contained in:
Joseph Sutton 2021-09-13 11:15:17 +12:00 committed by Jule Anger
parent 9d61f2f2f3
commit 5a90b3e832
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/ldb/pyldb.c
View File

@ -1804,6 +1804,7 @@ static PyObject *py_ldb_msg_diff(PyLdbObject *self, PyObject *args)
struct ldb_message *diff;
struct ldb_context *ldb;
PyObject *py_ret;
TALLOC_CTX *mem_ctx = NULL;
if (!PyArg_ParseTuple(args, "OO", &py_msg_old, &py_msg_new))
return NULL;
@ -1818,19 +1819,32 @@ static PyObject *py_ldb_msg_diff(PyLdbObject *self, PyObject *args)
return NULL;
}
mem_ctx = talloc_new(NULL);
if (mem_ctx == NULL) {
PyErr_NoMemory();
return NULL;
}
ldb = pyldb_Ldb_AS_LDBCONTEXT(self);
ldb_ret = ldb_msg_difference(ldb, ldb,
ldb_ret = ldb_msg_difference(ldb, mem_ctx,
pyldb_Message_AsMessage(py_msg_old),
pyldb_Message_AsMessage(py_msg_new),
&diff);
if (ldb_ret != LDB_SUCCESS) {
talloc_free(mem_ctx);
PyErr_SetString(PyExc_RuntimeError, "Failed to generate the Ldb Message diff");
return NULL;
}
diff = ldb_msg_copy(mem_ctx, diff);
if (diff == NULL) {
PyErr_NoMemory();
return NULL;
}
py_ret = PyLdbMessage_FromMessage(diff);
talloc_unlink(ldb, diff);
talloc_free(mem_ctx);
return py_ret;
}

1
selftest/knownfail.d/python-segfaults
View File

@ -1,2 +1 @@
samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_net_replicate_init__3
samba.tests.segfault.samba.tests.segfault.SegfaultTests.test_ldb_msg_diff