diff options
author | Gary Lockyer <gary@catalyst.net.nz> | 2019-02-19 10:26:56 +1300 |
---|---|---|
committer | Stefan Metzmacher <metze@samba.org> | 2019-02-26 07:51:11 +0100 |
commit | 2f6b4d11136f042f5c532199389877ed846c6f83 (patch) | |
tree | c604e2f0d94bd5a811c2d6b18a13d1bab0c192f6 | |
parent | 9b5a7c8abecbf605227cc974927c6d76f9bbbbb5 (diff) | |
download | samba-2f6b4d11136f042f5c532199389877ed846c6f83.tar.gz |
CVE-2019-3824 ldb: wildcard_match end of data check
ldb_handler_copy and ldb_val_dup over allocate by one and add a trailing '\0'
to the data, to make them safe to use the C string functions on.
However testing for the trailing '\0' is not the correct way to test for
the end of a value, the length should be checked instead.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
-rw-r--r-- | lib/ldb/common/ldb_match.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/ldb/common/ldb_match.c b/lib/ldb/common/ldb_match.c index 59f48b52b70..829afa77e71 100644 --- a/lib/ldb/common/ldb_match.c +++ b/lib/ldb/common/ldb_match.c @@ -353,7 +353,7 @@ static int ldb_wildcard_compare(struct ldb_context *ldb, } /* last chunk may not have reached end of string */ - if ( (! tree->u.substring.end_with_wildcard) && (*(val.data) != 0) ) goto mismatch; + if ( (! tree->u.substring.end_with_wildcard) && (val.length != 0) ) goto mismatch; talloc_free(save_p); *matched = true; return LDB_SUCCESS; |