1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-25 23:21:54 +03:00
samba-mirror/source4
Andrew Bartlett 32c333def9 CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls
Otherwise a paged search on the GC port will fail as the ->data was
not kept around for the second page of searches.

An example command to produce this is
 bin/ldbsearch --paged -H ldap://$SERVER:3268 -U$USERNAME%$PASSWORD

This shows up later in the partition module as:

ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00151ef20 at pc 0x7fec3f801aac bp 0x7ffe8472c270 sp 0x7ffe8472c260
READ of size 4 at 0x60b00151ef20 thread T0 (ldap(0))
    #0 0x7fec3f801aab in talloc_chunk_from_ptr ../../lib/talloc/talloc.c:526
    #1 0x7fec3f801aab in __talloc_get_name ../../lib/talloc/talloc.c:1559
    #2 0x7fec3f801aab in talloc_check_name ../../lib/talloc/talloc.c:1582
    #3 0x7fec1b86b2e1 in partition_search ../../source4/dsdb/samdb/ldb_modules/partition.c:780

or

smb_panic_default: PANIC (pid 13287): Bad talloc magic value - unknown value
(from source4/dsdb/samdb/ldb_modules/partition.c:780)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14402

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2020-07-02 09:01:41 +00:00
..
auth pyauth: add python binding for auth_session_info_set_unix() 2020-06-05 10:32:31 +00:00
build/pasn1
cldap_server source4 smdb: Add a post fork hook to the service API 2018-11-01 23:49:24 +01:00
client Fix clang 9 missing-field-initializer warnings 2020-05-08 09:31:31 +00:00
cluster dbwrap: Remove calls to loadparm 2018-04-24 01:53:19 +02:00
dns_server s4/rpc_server/dnsserver: Allow parsing of dnsProperty to fail gracefully 2020-05-15 07:29:16 +00:00
dsdb CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls 2020-07-02 09:01:41 +00:00
echo_server s4 echo_server: Enable prefork process model 2019-07-16 08:13:12 +00:00
heimdal heimdal: apply disallow-forwardable on server in TGS request 2020-06-12 20:42:38 +00:00
heimdal_build heimdal_build: Remove bashism from --address-sanitizer build rule 2020-01-18 12:25:16 +00:00
include lib: Remove global xfile.h includes 2016-11-20 06:23:19 +01:00
kdc db-glue.c: set forwardable flag on cross-realm tgt tickets 2020-06-12 22:10:34 +00:00
ldap_server s4 ldap_server: modernize debug calls 2020-05-06 21:15:42 +00:00
lib s3:lib:tls: Use better priority lists for modern GnuTLS 2020-06-17 17:42:02 +00:00
libcli source4/libcli: Use NT_STATUS_PENDING instead of STATUS_PENDING 2020-06-22 12:07:38 +00:00
libnet smbdes: convert E_old_pw_hash to use gnutls 2019-12-10 00:30:31 +00:00
librpc Fix clang 9 missing-field-initializer warnings 2020-05-08 09:31:31 +00:00
nbt_server smbdotconf: mark "wins hook" with substitution="1" 2019-11-27 10:25:36 +00:00
ntp_signd lib/crypto: move gnutls error wrapper to own subsystem 2019-06-27 12:54:22 +00:00
ntvfs ntvfs: Use NT_STATUS_NOTIFY_ENUM_DIR instead of STATUS_NOTIFY_ENUM_DIR 2020-06-22 12:07:38 +00:00
param Add python binding for DATADIR build path 2020-06-23 16:32:30 +00:00
rpc_server librpc: core: Move the s4 handles implementation to the RPC server core 2020-05-24 23:55:36 +00:00
script PY3: change shebang to python3 in source4/dsdb dir 2018-12-14 14:40:20 +01:00
scripting gpo: Run Group Policy Scripts 2020-06-23 16:32:30 +00:00
selftest CVE-2020-10745: librpc/tests: cmocka tests of dns and ndr strings 2020-07-02 09:01:41 +00:00
setup provision: Remove final code for the LDAP backend 2020-04-23 06:12:20 +00:00
smb_server source4/smb_server: Use NT_STATUS_PENDING instead of STATUS_PENDING 2020-06-22 12:07:38 +00:00
smbd lib/messaging: Move messages_dgm out of source3 2020-05-06 00:06:40 +00:00
torture s4:torture/smb2: adjust durable v2 tests to pass against Windows Server 2019 2020-06-27 04:20:39 +00:00
utils Fix clang 9 missing-field-initializer warnings 2020-05-08 09:31:31 +00:00
winbind s4/winbind: clang: Fixes 'Value stored during its initialization is never read' 2019-09-26 18:41:26 +00:00
wrepl_server source4 smdb: Add a post fork hook to the service API 2018-11-01 23:49:24 +01:00
.clang_complete
.valgrind_suppressions
wscript_build