Gary Lockyer 13658324a3 CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone ...

ldb_msg_add_empty reallocates the underlying element array, leaving
old_el pointing to freed memory.

This patch takes two defensive copies of the ldb message, and performs
the updates on them rather than the ldb messages in the result.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=14050

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

Autobuild-User(master): Karolin Seeger <kseeger@samba.org>
Autobuild-Date(master): Tue Jan 21 11:38:38 UTC 2020 on sn-devel-184

2020-01-21 11:38:38 +00:00

..

garbage_collect_tombstones.c

s4-kcc: Do not dereference a NULL pointer

2017-02-23 03:18:10 +01:00

garbage_collect_tombstones.h

dsdb: Expose ldb error string to dsdb_garbage_collect_tombstones() callers

2016-09-01 05:49:15 +02:00

kcc_connection.c

kcc: Remove unused, untested KCC code

2017-09-20 06:28:07 +02:00

kcc_connection.h

kcc_connection invocation_id added to struct

2011-07-14 07:05:10 +10:00

kcc_drs_replica_info.c

dlist: remove unneeded type argument from DLIST_ADD_END()

2016-02-06 21:48:17 +01:00

kcc_periodic.c

dns+kcc: adding dns scavenging to kcc periodic run

2018-07-12 04:31:55 +02:00

kcc_service.c

kcc: Give a better error message when samdb_ntds_objectGUID fails

2019-03-07 03:50:20 +00:00

kcc_service.h

dns+kcc: adding dns scavenging to kcc periodic run

2018-07-12 04:31:55 +02:00

scavenge_dns_records.c

CVE-2019-19344 kcc dns scavenging: Fix use after free in dns_tombstone_records_zone

2020-01-21 11:38:38 +00:00

scavenge_dns_records.h

dns: dns record scavenging function (without task)

2018-07-12 04:31:55 +02:00