diff options
| author | Joseph Sutton <josephsutton@catalyst.net.nz> | 2022-06-14 19:49:19 +1200 |
|---|---|---|
| committer | Jule Anger <janger@samba.org> | 2022-07-24 11:55:49 +0200 |
| commit | 47e2b1080e603b36b5d54a3e00f005983e6911e2 (patch) | |
| tree | 966e3c5e425f4774c7d25871b7e1ab2e5c166ad4 | |
| parent | 7c4439c7b7ff4caa7152f810ec9e83732fa70c3c (diff) | |
| download | samba-47e2b1080e603b36b5d54a3e00f005983e6911e2.tar.gz | |
CVE-2022-32746 s4/dsdb/repl_meta_data: Use LDB_FLAG_MOD_TYPE() for flags equality check
Now unrelated flags will no longer affect the result.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/repl_meta_data.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c index ab506cec488..29ffda75c87 100644 --- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c +++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c @@ -3525,7 +3525,7 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req) return ldb_module_operr(module); } - if (req->op.mod.message->elements[0].flags != LDB_FLAG_MOD_REPLACE) { + if (LDB_FLAG_MOD_TYPE(req->op.mod.message->elements[0].flags) != LDB_FLAG_MOD_REPLACE) { return ldb_module_operr(module); } @@ -3558,11 +3558,11 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req) return ldb_module_operr(module); } - if (req->op.mod.message->elements[0].flags != LDB_FLAG_MOD_DELETE) { + if (LDB_FLAG_MOD_TYPE(req->op.mod.message->elements[0].flags) != LDB_FLAG_MOD_DELETE) { return ldb_module_operr(module); } - if (req->op.mod.message->elements[1].flags != LDB_FLAG_MOD_ADD) { + if (LDB_FLAG_MOD_TYPE(req->op.mod.message->elements[1].flags) != LDB_FLAG_MOD_ADD) { return ldb_module_operr(module); } @@ -3645,7 +3645,7 @@ static int replmd_modify(struct ldb_module *module, struct ldb_request *req) return ldb_module_operr(module); } - if (msg->elements[0].flags != LDB_FLAG_MOD_ADD) { + if (LDB_FLAG_MOD_TYPE(msg->elements[0].flags) != LDB_FLAG_MOD_ADD) { talloc_free(ac); return ldb_module_operr(module); } |