1
0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
samba-mirror/source3/winbindd/wb_lookupusergroups.c
Noel Power 1788b59bc0 s3/winbindd: Fix bad access to sid array (with debug level >= info)
==6436==    at 0xA85F95B: dom_sid_string_buf (dom_sid.c:444)
==6436==    by 0xA85FBF2: dom_sid_str_buf (dom_sid.c:515)
==6436==    by 0x17EDF8: wb_lookupusergroups_recv (wb_lookupusergroups.c:115)
==6436==    by 0x17F964: wb_gettoken_gotgroups (wb_gettoken.c:123)
==6436==    by 0x56AD332: _tevent_req_notify_callback (tevent_req.c:141)
==6436==    by 0x56AD493: tevent_req_finish (tevent_req.c:193)
==6436==    by 0x56AD5C0: tevent_req_trigger (tevent_req.c:250)
==6436==    by 0x56AC119: tevent_common_invoke_immediate_handler (tevent_immediate.c:190)
==6436==    by 0x56AC268: tevent_common_loop_immediate (tevent_immediate.c:236)
==6436==    by 0x56B678A: epoll_event_loop_once (tevent_epoll.c:919)
==6436==    by 0x56B31C3: std_event_loop_once (tevent_standard.c:110)
==6436==    by 0x56AA621: _tevent_loop_once (tevent.c:825)
==6436==
==6436== Invalid read of size 1
==6436==    at 0xA85F95B: dom_sid_string_buf (dom_sid.c:444)
==6436==    by 0xA85FBF2: dom_sid_str_buf (dom_sid.c:515)
==6436==    by 0x17EDF8: wb_lookupusergroups_recv (wb_lookupusergroups.c:115)
==6436==    by 0x17F964: wb_gettoken_gotgroups (wb_gettoken.c:123)
==6436==    by 0x56AD332: _tevent_req_notify_callback (tevent_req.c:141)
==6436==    by 0x56AD493: tevent_req_finish (tevent_req.c:193)
==6436==    by 0x56AD5C0: tevent_req_trigger (tevent_req.c:250)
==6436==    by 0x56AC119: tevent_common_invoke_immediate_handler (tevent_immediate.c:190)
==6436==    by 0x56AC268: tevent_common_loop_immediate (tevent_immediate.c:236)
==6436==    by 0x56B678A: epoll_event_loop_once (tevent_epoll.c:919)
==6436==    by 0x56B31C3: std_event_loop_once (tevent_standard.c:110)
==6436==    by 0x56AA621: _tevent_loop_once (tevent.c:825)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15160
Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Wed Aug 31 15:07:31 UTC 2022 on sn-devel-184
2022-08-31 15:07:31 +00:00

121 lines
3.5 KiB
C

/*
Unix SMB/CIFS implementation.
async lookupusergroups
Copyright (C) Volker Lendecke 2009
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "winbindd.h"
#include "librpc/gen_ndr/ndr_winbind_c.h"
#include "../libcli/security/security.h"
struct wb_lookupusergroups_state {
struct tevent_context *ev;
struct dom_sid sid;
struct wbint_SidArray sids;
};
static void wb_lookupusergroups_done(struct tevent_req *subreq);
struct tevent_req *wb_lookupusergroups_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
const struct dom_sid *sid)
{
struct tevent_req *req, *subreq;
struct wb_lookupusergroups_state *state;
struct winbindd_domain *domain;
NTSTATUS status;
struct dom_sid_buf buf;
req = tevent_req_create(mem_ctx, &state,
struct wb_lookupusergroups_state);
if (req == NULL) {
return NULL;
}
D_INFO("WB command lookupusergroups start.\nLooking up SID %s.\n",
dom_sid_str_buf(sid, &buf));
sid_copy(&state->sid, sid);
status = lookup_usergroups_cached(state,
&state->sid,
&state->sids.num_sids,
&state->sids.sids);
if (NT_STATUS_IS_OK(status)) {
tevent_req_done(req);
return tevent_req_post(req, ev);
}
domain = find_domain_from_sid_noinit(&state->sid);
if (domain == NULL) {
DBG_WARNING("could not find domain entry for sid %s\n",
dom_sid_str_buf(&state->sid, &buf));
tevent_req_nterror(req, NT_STATUS_NO_SUCH_DOMAIN);
return tevent_req_post(req, ev);
}
subreq = dcerpc_wbint_LookupUserGroups_send(
state, ev, dom_child_handle(domain), &state->sid, &state->sids);
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
}
tevent_req_set_callback(subreq, wb_lookupusergroups_done, req);
return req;
}
static void wb_lookupusergroups_done(struct tevent_req *subreq)
{
struct tevent_req *req = tevent_req_callback_data(
subreq, struct tevent_req);
struct wb_lookupusergroups_state *state = tevent_req_data(
req, struct wb_lookupusergroups_state);
NTSTATUS status, result;
status = dcerpc_wbint_LookupUserGroups_recv(subreq, state, &result);
TALLOC_FREE(subreq);
if (any_nt_status_not_ok(status, result, &status)) {
D_WARNING("Failed with %s.\n", nt_errstr(status));
tevent_req_nterror(req, status);
return;
}
tevent_req_done(req);
}
NTSTATUS wb_lookupusergroups_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
uint32_t *num_sids, struct dom_sid **sids)
{
struct wb_lookupusergroups_state *state = tevent_req_data(
req, struct wb_lookupusergroups_state);
NTSTATUS status;
uint32_t i;
if (tevent_req_is_nterror(req, &status)) {
return status;
}
*num_sids = state->sids.num_sids;
*sids = talloc_move(mem_ctx, &state->sids.sids);
D_INFO("WB command lookupusergroups end.\nReceived %"PRIu32" SID(s).\n",
*num_sids);
if (CHECK_DEBUGLVL(DBGLVL_INFO)) {
for (i = 0; i < *num_sids; i++) {
struct dom_sid_buf buf;
D_INFO("%"PRIu32": %s\n",
i, dom_sid_str_buf(&(*sids)[i], &buf));
}
}
return NT_STATUS_OK;
}