CVE-2021-3670 ldap_server: Set timeout on requests based on MaxQueryDuration

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14694

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c
index e19f82cf5dfa3506e988083dea28ae95645b5a01..c7405f6664374b08df237b039c69d46217b0da89 100644 (file)
--- a/source4/ldap_server/ldap_backend.c
+++ b/source4/ldap_server/ldap_backend.c
@@ -869,7 +869,17 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
                }
        }
 
-       ldb_set_timeout(samdb, lreq, req->timelimit);
+       {
+               time_t timeout = call->conn->limits.search_timeout;
+
+               if (timeout == 0
+                   || (req->timelimit != 0
+                       && req->timelimit < timeout))
+               {
+                       timeout = req->timelimit;
+               }
+               ldb_set_timeout(samdb, lreq, timeout);
+       }
 
        if (!call->conn->is_privileged) {
                ldb_req_mark_untrusted(lreq);