From: Gary Lockyer <gary@catalyst.net.nz>
Date: Wed, 21 Feb 2018 02:19:37 +0000 (+1300)
Subject: ldb_tdb: Refuse to store a value in a unique index that is too long
X-Git-Tag: talloc-2.1.12~272
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ee74d4bb8052bf22dcc3b30abb2493ac9a3237a4;p=thirdparty%2Fsamba.git

ldb_tdb: Refuse to store a value in a unique index that is too long

Rather than add many special cases, over-long unique values are simply banned.

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/lib/ldb/ldb_tdb/ldb_index.c b/lib/ldb/ldb_tdb/ldb_index.c
index 343d95a7c9f..17cb267be78 100644
--- a/lib/ldb/ldb_tdb/ldb_index.c
+++ b/lib/ldb/ldb_tdb/ldb_index.c
@@ -2004,6 +2004,25 @@ static int ltdb_index_add1(struct ldb_module *module,
 		talloc_free(list);
 		return LDB_ERR_OPERATIONS_ERROR;
 	}
+	/*
+	 * Samba only maintains unique indexes on the objectSID and objectGUID
+	 * so if a unique index key exceeds the maximum length there is a
+	 * problem.
+	 */
+	if ((truncation == KEY_TRUNCATED) && (a != NULL &&
+		(a->flags & LDB_ATTR_FLAG_UNIQUE_INDEX ||
+		(el->flags & LDB_FLAG_INTERNAL_FORCE_UNIQUE_INDEX)))) {
+
+		ldb_asprintf_errstring(
+			ldb,
+			__location__ ": unique index key on %s in %s, "
+			"exceeds maximum key length of %u (encoded).",
+			el->name,
+			ldb_dn_get_linearized(msg->dn),
+			ltdb->max_key_length);
+		talloc_free(list);
+		return LDB_ERR_CONSTRAINT_VIOLATION;
+	}
 	talloc_steal(list, dn_key);
 
 	ret = ltdb_dn_list_load(module, ltdb, dn_key, list);