From: Philipp Gesang Date: Thu, 4 Oct 2018 07:25:14 +0000 (+0200) Subject: s3:secrets: clean up sid before storing X-Git-Tag: tdb-1.3.17~1276 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e310ad7e1ebabfb6d5f1a3cfd096da6cfe4a286c;p=thirdparty%2Fsamba.git s3:secrets: clean up sid before storing SIDs may contain non-zero memory beyond SubAuthorityCount: { key(15) = "SECRETS/SID/FOO" data(68) = "\01\04\00\00\00\00\00\05\15\00\00\00}u@\8C\08\A3\06nx\95\16\FE\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00`F\92\B7\03\00\00\00\18e\92\B7\03\00\00\00@H\92\B7\00\00\00\00" } These parts are lost when converting to ``string format syntax`` so a roundtrip conversion does not result in the same binary representation. Ensure that these never reach the tdb by using an initialized copy. This allows bitwise comparisons of secrets.tdb after dumping SIDs as text and reading them back. Signed-off-by: Philipp Gesang Reviewed-by: Volker Lendecke Reviewed-by: Andrew Bartlett Autobuild-User(master): Andrew Bartlett Autobuild-Date(master): Fri Oct 19 13:59:04 CEST 2018 on sn-devel-144 --- diff --git a/source3/passdb/machine_account_secrets.c b/source3/passdb/machine_account_secrets.c index a96bf1c0b6a..d8ffcaa7fb6 100644 --- a/source3/passdb/machine_account_secrets.c +++ b/source3/passdb/machine_account_secrets.c @@ -114,6 +114,7 @@ bool secrets_store_domain_sid(const char *domain, const struct dom_sid *sid) { char *protect_ids; bool ret; + struct dom_sid clean_sid = { 0 }; protect_ids = secrets_fetch(protect_ids_keystr(domain), NULL); if (protect_ids) { @@ -126,7 +127,15 @@ bool secrets_store_domain_sid(const char *domain, const struct dom_sid *sid) } SAFE_FREE(protect_ids); - ret = secrets_store(domain_sid_keystr(domain), sid, sizeof(struct dom_sid )); + /* + * use a copy to prevent uninitialized memory from being carried over + * to the tdb + */ + sid_copy(&clean_sid, sid); + + ret = secrets_store(domain_sid_keystr(domain), + &clean_sid, + sizeof(struct dom_sid)); /* Force a re-query, in the case where we modified our domain */ if (ret) {