|
|
509205 |
From 7d38a883dae528a0216733b4d831f2f20aa9c04b Mon Sep 17 00:00:00 2001
|
|
|
509205 |
From: Jeremy Allison <jra@samba.org>
|
|
|
509205 |
Date: Tue, 9 Jun 2015 12:42:10 -0700
|
|
|
509205 |
Subject: [PATCH 1/9] CVE-2015-3223: lib: ldb: Cope with canonicalise_fn
|
|
|
509205 |
returning string "", length 0.
|
|
|
509205 |
|
|
|
509205 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11325
|
|
|
509205 |
|
|
|
509205 |
Signed-off-by: Jeremy Allison <jra@samba.org>
|
|
|
509205 |
Reviewed-by: Ralph Boehme <slow@samba.org>
|
|
|
509205 |
---
|
|
|
509205 |
lib/ldb/common/ldb_match.c | 16 +++++++++++++++-
|
|
|
509205 |
1 file changed, 15 insertions(+), 1 deletion(-)
|
|
|
509205 |
|
|
|
509205 |
diff --git a/lib/ldb/common/ldb_match.c b/lib/ldb/common/ldb_match.c
|
|
|
509205 |
index a493dae..7414289 100644
|
|
|
509205 |
--- a/lib/ldb/common/ldb_match.c
|
|
|
509205 |
+++ b/lib/ldb/common/ldb_match.c
|
|
|
509205 |
@@ -271,6 +271,14 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
|
|
|
509205 |
if (cnk.length > val.length) {
|
|
|
509205 |
goto mismatch;
|
|
|
509205 |
}
|
|
|
509205 |
+ /*
|
|
|
509205 |
+ * Empty strings are returned as length 0. Ensure
|
|
|
509205 |
+ * we can cope with this.
|
|
|
509205 |
+ */
|
|
|
509205 |
+ if (cnk.length == 0) {
|
|
|
509205 |
+ goto mismatch;
|
|
|
509205 |
+ }
|
|
|
509205 |
+
|
|
|
509205 |
if (memcmp((char *)val.data, (char *)cnk.data, cnk.length) != 0) goto mismatch;
|
|
|
509205 |
val.length -= cnk.length;
|
|
|
509205 |
val.data += cnk.length;
|
|
|
509205 |
@@ -284,7 +292,13 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
|
|
|
509205 |
chunk = tree->u.substring.chunks[c];
|
|
|
509205 |
if(a->syntax->canonicalise_fn(ldb, ldb, chunk, &cnk) != 0) goto mismatch;
|
|
|
509205 |
|
|
|
509205 |
- /* FIXME: case of embedded nulls */
|
|
|
509205 |
+ /*
|
|
|
509205 |
+ * Empty strings are returned as length 0. Ensure
|
|
|
509205 |
+ * we can cope with this.
|
|
|
509205 |
+ */
|
|
|
509205 |
+ if (cnk.length == 0) {
|
|
|
509205 |
+ goto mismatch;
|
|
|
509205 |
+ }
|
|
|
509205 |
p = strstr((char *)val.data, (char *)cnk.data);
|
|
|
509205 |
if (p == NULL) goto mismatch;
|
|
|
509205 |
if ( (! tree->u.substring.chunks[c + 1]) && (! tree->u.substring.end_with_wildcard) ) {
|
|
|
509205 |
--
|
|
|
509205 |
2.5.0
|