Joseph Sutton a2bb5beee8 CVE-2022-32746 ldb: Ensure shallow copy modifications do not affect original message ...

Using the newly added ldb flag, we can now detect when a message has
been shallow-copied so that its elements share their values with the
original message elements. Then when adding values to the copied
message, we now make a copy of the shared values array first.

This should prevent a use-after-free that occurred in LDB modules when
new values were added to a shallow copy of a message by calling
talloc_realloc() on the original values array, invalidating the 'values'
pointer in the original message element. The original values pointer can
later be used in the database audit logging module which logs database
requests, and potentially cause a crash.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>

2022-07-27 10:52:36 +00:00

..

tests

ldb: cmocka test for empty attributes bug

2019-03-29 17:29:31 +00:00

dsdb_access.c

dsdb: remove a wrong comment in dsdb_check_access_on_dn_internal()

2013-06-13 18:19:24 +02:00

dsdb_dn.c

dsdb/common: dsdb_dn_construct_internal() more strict checking

2022-01-12 02:20:27 +00:00

dsdb_dn.h

dsdb: Define syntax access point oid string as a macro

2014-12-22 00:18:09 +01:00

rodc_helper.c

CVE-2020-25718 kdc: Return ERR_POLICY if RODC krbtgt account is invalid

2021-11-09 19:45:34 +00:00

util_groups.c

Remove a number of NT_STATUS_HAVE_NO_MEMORY_AND_FREE macros from the codebase.

2014-03-05 16:33:21 +01:00

util_links.c

Fix gcc11 compiler issue "-Werror=maybe-uninitialized"

2021-05-07 06:23:32 +00:00

util_links.h

dsdb: make get_parsed_dns_trusted() a common helper function

2019-02-13 04:15:14 +01:00

util_samr.c

Remove unnecessary/incorrect talloc_steal() calls

2020-03-05 18:40:16 +00:00

util_trusts.c

lib/util: remove extra safe_string.h file

2020-08-28 02:18:40 +00:00

util.c

CVE-2022-32746 ldb: Ensure shallow copy modifications do not affect original message

2022-07-27 10:52:36 +00:00

util.h

util: Remove unused NS_GUID_string() and NS_GUID_from_string()

2019-09-01 23:55:38 +00:00