CVE-2023-0614 libcli/security: Make some parameters const

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
[abartlet@samba.org Updated to add const to sec_access_check_ds()
instead of the sec_access_check_ds_implicit_owner() wrapper
found in 4.18 and later]

diff --git a/libcli/security/access_check.c b/libcli/security/access_check.c
index 322f4fdb0c64d572d76b667c632e9421428e797b..6508b6f3fe32d350fdbdfa7cdcb5d3fc5e8d6b04 100644 (file)
--- a/libcli/security/access_check.c
+++ b/libcli/security/access_check.c
@@ -394,7 +394,7 @@ NTSTATUS se_file_access_check(const struct security_descriptor *sd,
        return NT_STATUS_OK;
 }
 
-static const struct GUID *get_ace_object_type(struct security_ace *ace)
+static const struct GUID *get_ace_object_type(const struct security_ace *ace)
 {
        if (ace->object.object.flags & SEC_ACE_OBJECT_TYPE_PRESENT) {
                return &ace->object.object.type.type;
@@ -412,7 +412,7 @@ static const struct GUID *get_ace_object_type(struct security_ace *ace)
  *                            rights to the object/attribute
  * @returns NT_STATUS_OK, unless access was denied
  */
-static NTSTATUS check_object_specific_access(struct security_ace *ace,
+static NTSTATUS check_object_specific_access(const struct security_ace *ace,
                                             struct object_tree *tree,
                                             bool *grant_access)
 {
@@ -505,7 +505,7 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
                             uint32_t access_desired,
                             uint32_t *access_granted,
                             struct object_tree *tree,
-                            struct dom_sid *replace_sid)
+                            const struct dom_sid *replace_sid)
 {
        uint32_t i;
        uint32_t bits_remaining;
@@ -556,8 +556,8 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
 
        /* check each ace in turn. */
        for (i=0; bits_remaining && i < sd->dacl->num_aces; i++) {
-               struct dom_sid *trustee;
-               struct security_ace *ace = &sd->dacl->aces[i];
+               const struct dom_sid *trustee;
+               const struct security_ace *ace = &sd->dacl->aces[i];
                NTSTATUS status;
                bool grant_access = false;
 

diff --git a/libcli/security/access_check.h b/libcli/security/access_check.h
index 952589dacb7794fbf8d934dcb8638d6177d3fce9..04ea2127b61203ea68ebdc1ea1846556c5f16641 100644 (file)
--- a/libcli/security/access_check.h
+++ b/libcli/security/access_check.h
@@ -74,7 +74,7 @@ NTSTATUS sec_access_check_ds(const struct security_descriptor *sd,
                             uint32_t access_desired,
                             uint32_t *access_granted,
                             struct object_tree *tree,
-                            struct dom_sid *replace_sid);
+                            const struct dom_sid *replace_sid);
 
 bool insert_in_object_tree(TALLOC_CTX *mem_ctx,
                           const struct GUID *guid,