From: Tim Beale <timbeale@catalyst.net.nz>
Date: Mon, 30 Jul 2018 04:00:15 +0000 (+1200)
Subject: CVE-2018-10919 acl_read: Flip the logic in the dirsync check
X-Git-Tag: samba-4.6.16~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9605ecc7e1a79fa1b7cdf9f53048595ee00008b2;p=thirdparty%2Fsamba.git

CVE-2018-10919 acl_read: Flip the logic in the dirsync check

This better reflects the special case we're making for dirsync, and gets
rid of a 'if-else' clause.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13434

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
---

diff --git a/source4/dsdb/samdb/ldb_modules/acl_read.c b/source4/dsdb/samdb/ldb_modules/acl_read.c
index 75642b305c5..00203f21dae 100644
--- a/source4/dsdb/samdb/ldb_modules/acl_read.c
+++ b/source4/dsdb/samdb/ldb_modules/acl_read.c
@@ -241,10 +241,12 @@ static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
 			if (ret == LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS) {
 				bool in_search_filter;
 
+				/* check if attr is part of the search filter */
 				in_search_filter = dsdb_attr_in_parse_tree(ac->req->op.search.tree,
 								msg->elements[i].name);
 
-				if (ac->indirsync) {
+				if (in_search_filter) {
+
 					/*
 					 * We are doing dirysnc answers
 					 * and the object shouldn't be returned (normally)
@@ -253,21 +255,16 @@ static int aclread_callback(struct ldb_request *req, struct ldb_reply *ares)
 					 * (remove the object if it is not deleted, or return
 					 * just the objectGUID if it's deleted).
 					 */
-					if (in_search_filter) {
+					if (ac->indirsync) {
 						ldb_msg_remove_attr(msg, "replPropertyMetaData");
 						break;
 					} else {
-						aclread_mark_inaccesslible(&msg->elements[i]);
-					}
-				} else {
-					/*
-					 * do not return this entry if attribute is
-					 * part of the search filter
-					 */
-					if (in_search_filter) {
+
+						/* do not return this entry */
 						talloc_free(tmp_ctx);
 						return LDB_SUCCESS;
 					}
+				} else {
 					aclread_mark_inaccesslible(&msg->elements[i]);
 				}
 			} else if (ret != LDB_SUCCESS) {