diff options
| author | Garming Sam <garming@catalyst.net.nz> | 2018-11-05 16:18:18 +1300 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2018-11-26 08:54:31 +0100 |
| commit | fff405ae28bd2ddc2e2a876c21229726e78461e7 (patch) | |
| tree | 2778e2c06f9e78a9f4ca462d201f5a6d091133c3 /source4/ldap_server | |
| parent | b904c680eed3c027e65badb696693b210289e85b (diff) | |
| download | samba-fff405ae28bd2ddc2e2a876c21229726e78461e7.tar.gz | |
CVE-2018-16851 ldap_server: Check ret before manipulating blob
In the case of hitting the talloc ~256MB limit, this causes a crash in
the server.
Note that you would actually need to load >256MB of data into the LDAP.
Although there is some generated/hidden data which would help you reach that
limit (descriptors and RMD blobs).
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13674
Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4/ldap_server')
| -rw-r--r-- | source4/ldap_server/ldap_server.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c index 5f7efe90bba..d754c4dae78 100644 --- a/source4/ldap_server/ldap_server.c +++ b/source4/ldap_server/ldap_server.c @@ -675,13 +675,13 @@ static void ldapsrv_call_writev_start(struct ldapsrv_call *call) ret = data_blob_append(call, &blob, b.data, b.length); data_blob_free(&b); - talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet"); - if (!ret) { ldapsrv_terminate_connection(conn, "data_blob_append failed"); return; } + talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet"); + DLIST_REMOVE(call->replies, call->replies); } |