ldb: avoid NULL deref in ldb_db_compare

This also sorts NULLs after invalid DNs, which matches the comment
above.

CID 1596622.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625

Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit af7654331fb6a2d9cc41cf5bdffa74c81ff4ffee)

diff --git a/lib/ldb/common/ldb_dn.c b/lib/ldb/common/ldb_dn.c
index 92fa223ceb7859216c03287e5ce318300a9fbc12..8388fdb73189384b89053acb686c78f6c7bcb3b9 100644 (file)
--- a/lib/ldb/common/ldb_dn.c
+++ b/lib/ldb/common/ldb_dn.c
@@ -1141,13 +1141,23 @@ int ldb_dn_compare(struct ldb_dn *dn0, struct ldb_dn *dn1)
         * | normal DNs, sorted | casefold failed DNs | invalid DNs | NULLs |
         */
 
-       if (dn0 == dn1 || (dn0->invalid && dn1->invalid)) {
+       if (dn0 == dn1) {
+               /* this includes the both-NULL case */
                return 0;
        }
-       if (dn0 == NULL || dn0->invalid) {
+       if (dn0 == NULL) {
                return 1;
        }
-       if (dn1 == NULL || dn1->invalid) {
+       if (dn1 == NULL) {
+               return -1;
+       }
+       if (dn0->invalid && dn1->invalid) {
+               return 0;
+       }
+       if (dn0->invalid) {
+               return 1;
+       }
+       if (dn1->invalid) {
                return -1;
        }