CVE-2023-0614 ldb: Add function to take ownership of an ldb message

Many places in Samba depend upon various components of an ldb message
being talloc allocated, and hence able to be used as talloc contexts.
The elements and values of an unpacked ldb message point to unowned data
inside the memory-mapped database, and this function ensures that such
messages have talloc ownership of said elements and values.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/ldb/common/ldb_pack.c b/lib/ldb/common/ldb_pack.c
index e7dd364008a9db7ca35a34e7c180b6c523dba1a3..028d96a619ad1e5b5af0f61cff64b8e3712caad2 100644 (file)
--- a/lib/ldb/common/ldb_pack.c
+++ b/lib/ldb/common/ldb_pack.c
@@ -690,6 +690,7 @@ static int ldb_unpack_data_flags_v1(struct ldb_context *ldb,
                element->values = NULL;
                if ((flags & LDB_UNPACK_DATA_FLAG_NO_VALUES_ALLOC) && element->num_values == 1) {
                        element->values = &ldb_val_single_array[nelem];
+                       element->flags |= LDB_FLAG_INTERNAL_SHARED_VALUES;
                } else if (element->num_values != 0) {
                        element->values = talloc_array(message->elements,
                                                       struct ldb_val,
@@ -932,6 +933,7 @@ static int ldb_unpack_data_flags_v2(struct ldb_context *ldb,
                if ((flags & LDB_UNPACK_DATA_FLAG_NO_VALUES_ALLOC) &&
                    element->num_values == 1) {
                        element->values = &ldb_val_single_array[nelem];
+                       element->flags |= LDB_FLAG_INTERNAL_SHARED_VALUES;
                } else if (element->num_values != 0) {
                        element->values = talloc_array(message->elements,
                                                       struct ldb_val,
@@ -1259,3 +1261,42 @@ failed:
        TALLOC_FREE(filtered_msg->elements);
        return -1;
 }
+
+/* Have an unpacked ldb message take talloc ownership of its elements. */
+int ldb_msg_elements_take_ownership(struct ldb_message *msg)
+{
+       unsigned int i = 0;
+
+       for (i = 0; i < msg->num_elements; i++) {
+               struct ldb_message_element *el = &msg->elements[i];
+               const char *name;
+               unsigned int j;
+
+               name = talloc_strdup(msg->elements,
+                                    el->name);
+               if (name == NULL) {
+                       return -1;
+               }
+               el->name = name;
+
+               if (el->flags & LDB_FLAG_INTERNAL_SHARED_VALUES) {
+                       struct ldb_val *values = talloc_memdup(msg->elements, el->values,
+                                                              sizeof(struct ldb_val) * el->num_values);
+                       if (values == NULL) {
+                               return -1;
+                       }
+                       el->values = values;
+                       el->flags &= ~LDB_FLAG_INTERNAL_SHARED_VALUES;
+               }
+
+               for (j = 0; j < el->num_values; j++) {
+                       struct ldb_val val = ldb_val_dup(el->values, &el->values[j]);
+                       if (val.data == NULL && el->values[j].length != 0) {
+                               return -1;
+                       }
+                       el->values[j] = val;
+               }
+       }
+
+       return LDB_SUCCESS;
+}

diff --git a/lib/ldb/include/ldb_module.h b/lib/ldb/include/ldb_module.h
index 8481fd3991a231835133dd64cf86f6656a2bc8c5..8c7f33496fbaff80629d779ce58c8d3a954d9792 100644 (file)
--- a/lib/ldb/include/ldb_module.h
+++ b/lib/ldb/include/ldb_module.h
@@ -542,6 +542,10 @@ int ldb_filter_attrs(struct ldb_context *ldb,
                     const struct ldb_message *msg,
                     const char *const *attrs,
                     struct ldb_message *filtered_msg);
+
+/* Have an unpacked ldb message take talloc ownership of its elements. */
+int ldb_msg_elements_take_ownership(struct ldb_message *msg);
+
 /*
  * Unpack a ldb message from a linear buffer in ldb_val
  *