]> git.ipfire.org Git - thirdparty/samba.git/commit
CVE-2020-25717 wb_sids2xids: inline wb_sids2xids_extract_for_domain_index() into...
authorStefan Metzmacher <metze@samba.org>
Tue, 15 Sep 2020 11:36:43 +0000 (13:36 +0200)
committerJule Anger <janger@samba.org>
Mon, 8 Nov 2021 09:52:09 +0000 (10:52 +0100)
commit5e4491e84555fbf32b50ec08e3a8027f9ab38e9c
tree2afd80aff665b2e0f56b82d14a4710d8b1cc22a4
parentca5cf8d35b9756c9d65831718c5032533612c94a
CVE-2020-25717 wb_sids2xids: inline wb_sids2xids_extract_for_domain_index() into wb_sids2xids_next_sids2unix()

Instead of re-creating the dom_ids element,
we just use a pre-allocated map_ids_in array.

This is a bit tricky as we need to use map_ids_out as a copy of
map_ids_in, because the _ids argument of dcerpc_wbint_Sids2UnixIDs_send()
in [in,out], which means that _ids->ids is changed between
dcerpc_wbint_Sids2UnixIDs_send() and dcerpc_wbint_Sids2UnixIDs_recv()!

If the domain doesn't need any mappings, we'll move to the next domain
early, for now this can't happend but it will in future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit f6bb0ed21f82f2cf1f238f9f00cd049ecf8673af)
source3/winbindd/wb_sids2xids.c