From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 15 Sep 2020 11:58:26 +0000 (+0200)
Subject: CVE-2020-25717 wb_sids2xids: change 'i' to 'li' in wb_sids2xids_lookupsids_done()
X-Git-Tag: samba-4.13.14~245
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ed7664036183256d109a652aee39ff9842680d47;p=thirdparty%2Fsamba.git

CVE-2020-25717 wb_sids2xids: change 'i' to 'li' in wb_sids2xids_lookupsids_done()

With all the indexes we have into various array, this makes clear
'li' is the index into the state->lookup_sids array.

This makes the following changes easier to review.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14556

(cherry picked from commit 19c8b6a8b188e45a6342a3d1308085800388a38e)
---

diff --git a/source3/winbindd/wb_sids2xids.c b/source3/winbindd/wb_sids2xids.c
index d6655402b57..f01e36e6e55 100644
--- a/source3/winbindd/wb_sids2xids.c
+++ b/source3/winbindd/wb_sids2xids.c
@@ -235,7 +235,7 @@ static void wb_sids2xids_lookupsids_done(struct tevent_req *subreq)
 	struct lsa_RefDomainList *domains = NULL;
 	struct lsa_TransNameArray *names = NULL;
 	NTSTATUS status;
-	uint32_t i;
+	uint32_t li;
 
 	status = wb_lookupsids_recv(subreq, state, &domains, &names);
 	TALLOC_FREE(subreq);
@@ -250,11 +250,11 @@ static void wb_sids2xids_lookupsids_done(struct tevent_req *subreq)
 		return;
 	}
 
-	for (i=0; i<state->lookup_count; i++) {
-		const struct dom_sid *sid = &state->lookup_sids[i];
+	for (li = 0; li < state->lookup_count; li++) {
+		const struct dom_sid *sid = &state->lookup_sids[li];
 		struct dom_sid dom_sid;
-		struct lsa_TranslatedName *n = &names->names[i];
-		struct wbint_TransID *t = &state->ids.ids[i];
+		struct lsa_TranslatedName *n = &names->names[li];
+		struct wbint_TransID *t = &state->ids.ids[li];
 		int domain_index;
 		const char *domain_name = NULL;