55 lines
2.0 KiB
Diff
55 lines
2.0 KiB
Diff
From c1973cedbaa5313448a436f86dc4d662efbe497e Mon Sep 17 00:00:00 2001
|
|
From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
Date: Wed, 11 Aug 2021 16:56:07 +1200
|
|
Subject: [PATCH 141/266] CVE-2020-25722 s4/dsdb/cracknames: always free
|
|
tmp_ctx in spn_alias
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14564
|
|
|
|
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
|
Conflict:NA
|
|
Reference:https://gitlab.com/samba-team/samba/-/commit/c1973cedbaa5313448a436f86dc4d662efbe497e
|
|
---
|
|
source4/dsdb/samdb/cracknames.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/source4/dsdb/samdb/cracknames.c b/source4/dsdb/samdb/cracknames.c
|
|
index b4bd9d8f9c9..7336778ec53 100644
|
|
--- a/source4/dsdb/samdb/cracknames.c
|
|
+++ b/source4/dsdb/samdb/cracknames.c
|
|
@@ -99,10 +99,12 @@ static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, stru
|
|
|
|
service_dn = ldb_dn_new(tmp_ctx, ldb_ctx, "CN=Directory Service,CN=Windows NT,CN=Services");
|
|
if ( ! ldb_dn_add_base(service_dn, ldb_get_config_basedn(ldb_ctx))) {
|
|
+ talloc_free(tmp_ctx);
|
|
return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
|
|
}
|
|
service_dn_str = ldb_dn_alloc_linearized(tmp_ctx, service_dn);
|
|
if ( ! service_dn_str) {
|
|
+ talloc_free(tmp_ctx);
|
|
return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
|
|
}
|
|
|
|
@@ -111,13 +113,15 @@ static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, stru
|
|
|
|
if (ret != LDB_SUCCESS && ret != LDB_ERR_NO_SUCH_OBJECT) {
|
|
DEBUG(1, ("ldb_search: dn: %s not found: %s\n", service_dn_str, ldb_errstring(ldb_ctx)));
|
|
+ talloc_free(tmp_ctx);
|
|
return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
|
|
} else if (ret == LDB_ERR_NO_SUCH_OBJECT) {
|
|
DEBUG(1, ("ldb_search: dn: %s not found\n", service_dn_str));
|
|
+ talloc_free(tmp_ctx);
|
|
return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
|
|
} else if (res->count != 1) {
|
|
- talloc_free(res);
|
|
DEBUG(1, ("ldb_search: dn: %s not found\n", service_dn_str));
|
|
+ talloc_free(tmp_ctx);
|
|
return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
|
|
}
|
|
|
|
--
|
|
2.23.0
|
|
|