|
 |
b310f2 |
From 37f2e0f0658d78a1496dc277f402f8b577ce6aae Mon Sep 17 00:00:00 2001
|
|
|
b310f2 |
From: Klaus Espenlaub <klaus@espenlaub.com>
|
|
|
b310f2 |
Date: Tue, 8 Feb 2022 20:34:40 +0000
|
|
|
b310f2 |
Subject: [PATCH] CVE-2022-24407 Escape password for SQL insert/update
|
|
|
b310f2 |
commands.
|
|
|
b310f2 |
|
|
|
b310f2 |
Signed-off-by: Klaus Espenlaub <klaus@espenlaub.com>
|
|
|
b310f2 |
---
|
|
|
b310f2 |
plugins/sql.c | 26 +++++++++++++++++++++++---
|
|
|
b310f2 |
1 file changed, 23 insertions(+), 3 deletions(-)
|
|
|
b310f2 |
|
|
|
b310f2 |
diff --git a/plugins/sql.c b/plugins/sql.c
|
|
|
b310f2 |
index 31b54a78..6ac81c2f 100644
|
|
|
b310f2 |
--- a/plugins/sql.c
|
|
|
b310f2 |
+++ b/plugins/sql.c
|
|
|
b310f2 |
@@ -1151,6 +1151,7 @@ static int sql_auxprop_store(void *glob_context,
|
|
|
b310f2 |
char *statement = NULL;
|
|
|
b310f2 |
char *escap_userid = NULL;
|
|
|
b310f2 |
char *escap_realm = NULL;
|
|
|
b310f2 |
+ char *escap_passwd = NULL;
|
|
|
b310f2 |
const char *cmd;
|
|
|
b310f2 |
|
|
|
b310f2 |
sql_settings_t *settings;
|
|
|
b310f2 |
@@ -1222,6 +1223,11 @@ static int sql_auxprop_store(void *glob_context,
|
|
|
b310f2 |
"Unable to begin transaction\n");
|
|
|
b310f2 |
}
|
|
|
b310f2 |
for (cur = to_store; ret == SASL_OK && cur->name; cur++) {
|
|
|
b310f2 |
+ /* Free the buffer, current content is from previous loop. */
|
|
|
b310f2 |
+ if (escap_passwd) {
|
|
|
b310f2 |
+ sparams->utils->free(escap_passwd);
|
|
|
b310f2 |
+ escap_passwd = NULL;
|
|
|
b310f2 |
+ }
|
|
|
b310f2 |
|
|
|
b310f2 |
if (cur->name[0] == '*') {
|
|
|
b310f2 |
continue;
|
|
|
b310f2 |
@@ -1243,19 +1249,32 @@ static int sql_auxprop_store(void *glob_context,
|
|
|
b310f2 |
}
|
|
|
b310f2 |
sparams->utils->free(statement);
|
|
|
b310f2 |
|
|
|
b310f2 |
+ if (cur->values[0]) {
|
|
|
b310f2 |
+ escap_passwd = (char *)sparams->utils->malloc(strlen(cur->values[0])*2+1);
|
|
|
b310f2 |
+ if (!escap_passwd) {
|
|
|
b310f2 |
+ ret = SASL_NOMEM;
|
|
|
b310f2 |
+ break;
|
|
|
b310f2 |
+ }
|
|
|
b310f2 |
+ settings->sql_engine->sql_escape_str(escap_passwd, cur->values[0]);
|
|
|
b310f2 |
+ }
|
|
|
b310f2 |
+
|
|
|
b310f2 |
/* create a statement that we will use */
|
|
|
b310f2 |
statement = sql_create_statement(cmd, cur->name, escap_userid,
|
|
|
b310f2 |
escap_realm,
|
|
|
b310f2 |
- cur->values && cur->values[0] ?
|
|
|
b310f2 |
- cur->values[0] : SQL_NULL_VALUE,
|
|
|
b310f2 |
+ escap_passwd ?
|
|
|
b310f2 |
+ escap_passwd : SQL_NULL_VALUE,
|
|
|
b310f2 |
sparams->utils);
|
|
|
b310f2 |
+ if (!statement) {
|
|
|
b310f2 |
+ ret = SASL_NOMEM;
|
|
|
b310f2 |
+ break;
|
|
|
b310f2 |
+ }
|
|
|
b310f2 |
|
|
|
b310f2 |
{
|
|
|
b310f2 |
char *log_statement =
|
|
|
b310f2 |
sql_create_statement(cmd, cur->name,
|
|
|
b310f2 |
escap_userid,
|
|
|
b310f2 |
escap_realm,
|
|
|
b310f2 |
- cur->values && cur->values[0] ?
|
|
|
b310f2 |
+ escap_passwd ?
|
|
|
b310f2 |
"<omitted>" : SQL_NULL_VALUE,
|
|
|
b310f2 |
sparams->utils);
|
|
|
b310f2 |
sparams->utils->log(sparams->utils->conn, SASL_LOG_DEBUG,
|
|
|
b310f2 |
@@ -1288,6 +1307,7 @@ static int sql_auxprop_store(void *glob_context,
|
|
|
b310f2 |
done:
|
|
|
b310f2 |
if (escap_userid) sparams->utils->free(escap_userid);
|
|
|
b310f2 |
if (escap_realm) sparams->utils->free(escap_realm);
|
|
|
b310f2 |
+ if (escap_passwd) sparams->utils->free(escap_passwd);
|
|
|
b310f2 |
if (conn) settings->sql_engine->sql_close(conn);
|
|
|
b310f2 |
if (userid) sparams->utils->free(userid);
|
|
|
b310f2 |
if (realm) sparams->utils->free(realm);
|
|
|
b310f2 |
--
|
|
|
b310f2 |
2.25.1
|
|
|
b310f2 |
|