sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-08 05:57:51 +03:00
Code

ldb-samba: dns tombstone matching: constrict value length

Browse Source 
We know the only values we want to see are uint32, ie < ~4 billion
(and real values will be 7 digits for hundreds of years).

We also know the caller (we have just checked) is a trusted system
session which won't be padding the thing with spaces. But if they do,
let's call them out.

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Douglas Bagnall 2021-03-29 13:03:45 +13:00 committed by Andrew Bartlett
parent 7a111c1f35
commit b80f66f803
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/ldb-samba/ldb_matching_rules.c
View File

@ -336,7 +336,9 @@ static int ldb_comparator_trans(struct ldb_context *ldb,
* *
* This allows a search filter such as: * This allows a search filter such as:
* *
* dnsRecord:1.3.6.1.4.1.7165.4.5.3:=131139216000000000 * dnsRecord:1.3.6.1.4.1.7165.4.5.3:=3694869
*
* where the value is a number of hours since the start of 1601.
* *
* This allows the caller to find records that should become a DNS * This allows the caller to find records that should become a DNS
* tomestone, despite that information being deep within an NDR packed * tomestone, despite that information being deep within an NDR packed
@ -380,13 +382,13 @@ static int dsdb_match_for_dns_to_tombstone_time(struct ldb_context *ldb,
return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS; return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS;
} }
/* Just check we don't allow the caller to fill our stack */ /* We only expect uint32_t <= 10 digits */
if (value_to_match->length >= 64) { if (value_to_match->length >= 12) {
DBG_ERR("Invalid timestamp passed\n"); DBG_ERR("Invalid timestamp passed\n");
return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX; return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
} else { } else {
int error = 0; int error = 0;
char s[65]; char s[12];
memcpy(s, value_to_match->data, value_to_match->length); memcpy(s, value_to_match->data, value_to_match->length);
s[value_to_match->length] = 0; s[value_to_match->length] = 0;