sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

CVE-2023-34968: mdscli: remove response blob allocation

Browse Source 
This is handled by the NDR code transparently.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15388

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Ralph Boehme 2023-06-19 18:28:41 +02:00 committed by Jule Anger
parent 617fe37cc2
commit e85e09eee9
1 changed files with 0 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
source3/rpc_client/cli_mdssvc.c
View File

@ -276,15 +276,6 @@ struct tevent_req *mdscli_search_send(TALLOC_CTX *mem_ctx,
return tevent_req_post(req, ev);
}
state->response_blob.spotlight_blob = talloc_array(
state,
uint8_t,
mdscli_ctx->max_fragment_size);
if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
return tevent_req_post(req, ev);
}
state->response_blob.size = mdscli_ctx->max_fragment_size;
subreq = dcerpc_mdssvc_cmd_send(state,
ev,
mdscli_ctx->bh,
@ -457,15 +448,6 @@ struct tevent_req *mdscli_get_results_send(
return tevent_req_post(req, ev);
}
state->response_blob.spotlight_blob = talloc_array(
state,
uint8_t,
mdscli_ctx->max_fragment_size);
if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
return tevent_req_post(req, ev);
}
state->response_blob.size = mdscli_ctx->max_fragment_size;
subreq = dcerpc_mdssvc_cmd_send(state,
ev,
mdscli_ctx->bh,
@ -681,15 +663,6 @@ struct tevent_req *mdscli_get_path_send(TALLOC_CTX *mem_ctx,
return tevent_req_post(req, ev);
}
state->response_blob.spotlight_blob = talloc_array(
state,
uint8_t,
mdscli_ctx->max_fragment_size);
if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
return tevent_req_post(req, ev);
}
state->response_blob.size = mdscli_ctx->max_fragment_size;
subreq = dcerpc_mdssvc_cmd_send(state,
ev,
mdscli_ctx->bh,
@ -852,15 +825,6 @@ struct tevent_req *mdscli_close_search_send(TALLOC_CTX *mem_ctx,
return tevent_req_post(req, ev);
}
state->response_blob.spotlight_blob = talloc_array(
state,
uint8_t,
mdscli_ctx->max_fragment_size);
if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
return tevent_req_post(req, ev);
}
state->response_blob.size = mdscli_ctx->max_fragment_size;
subreq = dcerpc_mdssvc_cmd_send(state,
ev,
mdscli_ctx->bh,