sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-24 10:50:22 +03:00
Code

CVE-2018-10919 acl_read: Small refactor to aclread_callback()

Browse Source 
Flip the dirsync check (to avoid a double negative), and use a helper
boolean variable.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
This commit is contained in:
Tim Beale 2018-07-26 12:20:49 +12:00 committed by Karolin Seeger
parent 6e35ae3761
commit f9fa4e5c93
1 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
source4/dsdb/samdb/ldb_modules/acl_read.c
View File

@ -398,18 +398,12 @@ static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
* in anycase.
*/
if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
if (!ac->indirsync) {
/*
* do not return this entry if attribute is
* part of the search filter
*/
if (dsdb_attr_in_parse_tree(ac->req->op.search.tree,
msg->elements[i].name)) {
talloc_free(tmp_ctx);
return LDB_SUCCESS;
}
aclread_mark_inaccesslible(&msg->elements[i]);
} else {
bool in_search_filter;
in_search_filter = dsdb_attr_in_parse_tree(ac->req->op.search.tree,
msg->elements[i].name);
if (ac->indirsync) {
/*
* We are doing dirysnc answers
* and the object shouldn't be returned (normally)
@ -418,13 +412,22 @@ static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
* (remove the object if it is not deleted, or return
* just the objectGUID if it's deleted).
*/
if (dsdb_attr_in_parse_tree(ac->req->op.search.tree,
msg->elements[i].name)) {
if (in_search_filter) {
ldb_msg_remove_attr(msg, "replPropertyMetaData");
break;
} else {
aclread_mark_inaccesslible(&msg->elements[i]);
}
} else {
/*
* do not return this entry if attribute is
* part of the search filter
*/
if (in_search_filter) {
talloc_free(tmp_ctx);
return LDB_SUCCESS;
}
aclread_mark_inaccesslible(&msg->elements[i]);
}
} else if (ret != LDB_SUCCESS) {
ldb_debug_set(ldb, LDB_DEBUG_FATAL,