diff options
| author | Andrew Bartlett <abartlet@samba.org> | 2004-01-05 23:18:06 +0000 |
|---|---|---|
| committer | Andrew Bartlett <abartlet@samba.org> | 2004-01-05 23:18:06 +0000 |
| commit | 74ea8682e4b5c78f456cc9284e953e35e4146a8b (patch) | |
| tree | 336a3f932284e715a1d0fe1609d9a5b6a7cb8695 | |
| parent | ef5d2309c2252c9d6111738075f863b69b616722 (diff) | |
| download | samba-74ea8682e4b5c78f456cc9284e953e35e4146a8b.tar.gz | |
(merge from 3.0)
Check the return value of string_to_sid in a few more places. (But
string_to_sid also needs to be less permissive on what it thinks are
valid sids...)
Andrew Bartlett
| -rw-r--r-- | source/passdb/pdb_ldap.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/source/passdb/pdb_ldap.c b/source/passdb/pdb_ldap.c index a1ac0424107..1f44f5ab605 100644 --- a/source/passdb/pdb_ldap.c +++ b/source/passdb/pdb_ldap.c @@ -1693,7 +1693,11 @@ static BOOL init_group_from_ldap(struct ldapsam_privates *ldap_state, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID))); return False; } - string_to_sid(&map->sid, temp); + + if (!string_to_sid(&map->sid, temp)) { + DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp)); + return False; + } if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry, get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) { @@ -1749,6 +1753,7 @@ static BOOL init_ldap_from_group(LDAP *ldap_struct, *mods = NULL; sid_to_string(tmp, &map->sid); + smbldap_make_mod(ldap_struct, existing, mods, get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID), tmp); pstr_sprintf(tmp, "%i", map->sid_name_use); @@ -2362,7 +2367,10 @@ and will risk BDCs having inconsistant SIDs\n")); get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), domain_sid_string)) { BOOL found_sid; - string_to_sid(&ldap_domain_sid, domain_sid_string); + if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) { + DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be read as a valid SID\n", domain_sid_string)); + return NT_STATUS_INVALID_PARAMETER; + } found_sid = secrets_fetch_domain_sid(ldap_state->domain_name, &secrets_domain_sid); if (!found_sid || !sid_equal(&secrets_domain_sid, &ldap_domain_sid)) { /* reset secrets.tdb sid */ |