43 lines
1.5 KiB
Diff
43 lines
1.5 KiB
Diff
From a94ea2c5bcb6d62b4fe6dda590cf3ed44616f6a2 Mon Sep 17 00:00:00 2001
|
|
From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
Date: Sat, 6 Mar 2021 16:05:15 +1300
|
|
Subject: [PATCH 003/284] CVE-2020-25718 ldb: fix ldb_comparison_fold
|
|
|
|
Conflict: NA
|
|
Reference: https://git.samba.org/samba.git/?p=samba.git;a=patch;h=a94ea2c5bcb6d62b4fe6dda590cf3ed44616f6a2
|
|
|
|
off-by-one overrun
|
|
|
|
We run one character over in comparing all the bytes in two ldb_vals.
|
|
|
|
In almost all circumstances both ldb_vals would have an allocated '\0'
|
|
in the overrun position, but it is best not to rely on that.
|
|
|
|
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
|
|
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
|
|
|
|
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14558
|
|
|
|
(cherry picked from commit 2b2f4f519454beb6f2a46705675a62274019fc09)
|
|
---
|
|
lib/ldb/common/attrib_handlers.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/lib/ldb/common/attrib_handlers.c b/lib/ldb/common/attrib_handlers.c
|
|
index f0fd4f50d8df..6a885065f773 100644
|
|
--- a/lib/ldb/common/attrib_handlers.c
|
|
+++ b/lib/ldb/common/attrib_handlers.c
|
|
@@ -334,8 +334,8 @@ int ldb_comparison_fold(struct ldb_context *ldb, void *mem_ctx,
|
|
if (toupper((unsigned char)*s1) != toupper((unsigned char)*s2))
|
|
break;
|
|
if (*s1 == ' ') {
|
|
- while (n1 && s1[0] == s1[1]) { s1++; n1--; }
|
|
- while (n2 && s2[0] == s2[1]) { s2++; n2--; }
|
|
+ while (n1 > 1 && s1[0] == s1[1]) { s1++; n1--; }
|
|
+ while (n2 > 1 && s2[0] == s2[1]) { s2++; n2--; }
|
|
}
|
|
s1++; s2++;
|
|
n1--; n2--;
|
|
--
|
|
2.25.1
|