From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 29 Nov 2022 14:42:27 +0000 (+0100)
Subject: CVE-2022-37966 s4:libnet: initialize libnet_SetPassword() arguments explicitly to... 
X-Git-Tag: samba-4.15.13~20
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eed3d6a3962e8e9d7076486679fedc9e0ec93acb;p=thirdparty%2Fsamba.git

CVE-2022-37966 s4:libnet: initialize libnet_SetPassword() arguments explicitly to zero by default.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 9e69289b099b47e0352ef67ef7e6529d11688e9a)
---

diff --git a/source4/libnet/libnet_join.c b/source4/libnet/libnet_join.c
index 825a81579cc..d1afb4f22b9 100644
--- a/source4/libnet/libnet_join.c
+++ b/source4/libnet/libnet_join.c
@@ -487,8 +487,8 @@ NTSTATUS libnet_JoinDomain(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, stru
 	const char *password_str = NULL;
 	
 	r->out.error_string = NULL;
-	r2.samr_handle.out.error_string = NULL;
-	
+	ZERO_STRUCT(r2);
+
 	tmp_ctx = talloc_named(mem_ctx, 0, "libnet_Join temp context");
 	if (!tmp_ctx) {
 		r->out.error_string = NULL;
diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
index 868f9442cd0..d2875719e22 100644
--- a/source4/libnet/libnet_passwd.c
+++ b/source4/libnet/libnet_passwd.c
@@ -832,6 +832,7 @@ static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *
 		goto disconnect;
 	}
 
+	ZERO_STRUCT(r2);
 	r2.samr_handle.level		= LIBNET_SET_PASSWORD_SAMR_HANDLE;
 	r2.samr_handle.in.account_name	= r->samr.in.account_name;
 	r2.samr_handle.in.newpassword	= r->samr.in.newpassword;
@@ -855,6 +856,7 @@ static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CT
 	NTSTATUS status;
 	union libnet_SetPassword r2;
 
+	ZERO_STRUCT(r2);
 	r2.samr.level		= LIBNET_SET_PASSWORD_SAMR;
 	r2.samr.in.account_name	= r->generic.in.account_name;
 	r2.samr.in.domain_name	= r->generic.in.domain_name;