CVE-2022-32746 ldb:rdn_name: Use LDB_FLAG_MOD_TYPE() for flags equality check

Now unrelated flags will no longer affect the result.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>

diff --git a/lib/ldb/modules/rdn_name.c b/lib/ldb/modules/rdn_name.c
index e69ad9315aece96bc4df126493416c9914918b4c..25cffe07591af1c741cbc13b88ef155b6b94f307 100644 (file)
--- a/lib/ldb/modules/rdn_name.c
+++ b/lib/ldb/modules/rdn_name.c
@@ -545,7 +545,7 @@ static int rdn_name_modify(struct ldb_module *module, struct ldb_request *req)
        if (e != NULL) {
                ldb_asprintf_errstring(ldb, "Modify of 'distinguishedName' on %s not permitted, must use 'rename' operation instead",
                                       ldb_dn_get_linearized(req->op.mod.message->dn));
-               if (e->flags == LDB_FLAG_MOD_REPLACE) {
+               if (LDB_FLAG_MOD_TYPE(e->flags) == LDB_FLAG_MOD_REPLACE) {
                        return LDB_ERR_CONSTRAINT_VIOLATION;
                } else {
                        return LDB_ERR_UNWILLING_TO_PERFORM;