|
 |
509205 |
From 85a1c62c942033f6e1b864aeb4fd72c4a8b3d38a Mon Sep 17 00:00:00 2001
|
|
|
509205 |
From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
|
509205 |
Date: Tue, 24 Nov 2015 13:09:36 +1300
|
|
|
509205 |
Subject: [PATCH 4/9] CVE-2015-5330: ldb_dn_escape_value: use known string
|
|
|
509205 |
length, not strlen()
|
|
|
509205 |
|
|
|
509205 |
ldb_dn_escape_internal() reports the number of bytes it copied, so
|
|
|
509205 |
lets use that number, rather than using strlen() and hoping a zero got
|
|
|
509205 |
in the right place.
|
|
|
509205 |
|
|
|
509205 |
Bug: https://bugzilla.samba.org/show_bug.cgi?id=11599
|
|
|
509205 |
|
|
|
509205 |
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
|
509205 |
Pair-programmed-with: Andrew Bartlett <abartlet@samba.org>
|
|
|
509205 |
Reviewed-by: Ralph Boehme <slow@samba.org>
|
|
|
509205 |
---
|
|
|
509205 |
lib/ldb/common/ldb_dn.c | 12 ++++++++----
|
|
|
509205 |
1 file changed, 8 insertions(+), 4 deletions(-)
|
|
|
509205 |
|
|
|
509205 |
diff --git a/lib/ldb/common/ldb_dn.c b/lib/ldb/common/ldb_dn.c
|
|
|
509205 |
index 1b8e51e..a3b8f92 100644
|
|
|
509205 |
--- a/lib/ldb/common/ldb_dn.c
|
|
|
509205 |
+++ b/lib/ldb/common/ldb_dn.c
|
|
|
509205 |
@@ -250,7 +250,7 @@ static int ldb_dn_escape_internal(char *dst, const char *src, int len)
|
|
|
509205 |
char *ldb_dn_escape_value(TALLOC_CTX *mem_ctx, struct ldb_val value)
|
|
|
509205 |
{
|
|
|
509205 |
char *dst;
|
|
|
509205 |
-
|
|
|
509205 |
+ size_t len;
|
|
|
509205 |
if (!value.length)
|
|
|
509205 |
return NULL;
|
|
|
509205 |
|
|
|
509205 |
@@ -261,10 +261,14 @@ char *ldb_dn_escape_value(TALLOC_CTX *mem_ctx, struct ldb_val value)
|
|
|
509205 |
return NULL;
|
|
|
509205 |
}
|
|
|
509205 |
|
|
|
509205 |
- ldb_dn_escape_internal(dst, (const char *)value.data, value.length);
|
|
|
509205 |
-
|
|
|
509205 |
- dst = talloc_realloc(mem_ctx, dst, char, strlen(dst) + 1);
|
|
|
509205 |
+ len = ldb_dn_escape_internal(dst, (const char *)value.data, value.length);
|
|
|
509205 |
|
|
|
509205 |
+ dst = talloc_realloc(mem_ctx, dst, char, len + 1);
|
|
|
509205 |
+ if ( ! dst) {
|
|
|
509205 |
+ talloc_free(dst);
|
|
|
509205 |
+ return NULL;
|
|
|
509205 |
+ }
|
|
|
509205 |
+ dst[len] = '\0';
|
|
|
509205 |
return dst;
|
|
|
509205 |
}
|
|
|
509205 |
|
|
|
509205 |
--
|
|
|
509205 |
2.5.0
|