From: Joseph Sutton Date: Mon, 30 Oct 2023 23:11:37 +0000 (+1300) Subject: s4:rpc_server: Properly initialize ‘lsa_CreateTrustedDomainEx2’ structure (CID 1499407) X-Git-Tag: talloc-2.4.2~873 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fa25793ebff92bee2bb1bf0b437b5f705ee8a1dc;p=thirdparty%2Fsamba.git s4:rpc_server: Properly initialize ‘lsa_CreateTrustedDomainEx2’ structure (CID 1499407) dcesrv_lsa_CreateTrustedDomain_base() invokes DCESRV_PULL_HANDLE(), which invokes DCESRV_PULL_HANDLE_RETVAL(), which invokes DCESRV_CHECK_HANDLE(), which might invoke DCESRV_FAULT(), which accesses r2.out.result, which is uninitialized — invoking undefined behaviour. Signed-off-by: Joseph Sutton Reviewed-by: Andrew Bartlett --- diff --git a/source4/rpc_server/lsa/dcesrv_lsa.c b/source4/rpc_server/lsa/dcesrv_lsa.c index 447789708f1..d1342747e88 100644 --- a/source4/rpc_server/lsa/dcesrv_lsa.c +++ b/source4/rpc_server/lsa/dcesrv_lsa.c @@ -1445,7 +1445,7 @@ static NTSTATUS dcesrv_lsa_CreateTrustedDomainEx(struct dcesrv_call_state *dce_c static NTSTATUS dcesrv_lsa_CreateTrustedDomain(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx, struct lsa_CreateTrustedDomain *r) { - struct lsa_CreateTrustedDomainEx2 r2; + struct lsa_CreateTrustedDomainEx2 r2 = {}; r2.in.policy_handle = r->in.policy_handle; r2.in.info = talloc(mem_ctx, struct lsa_TrustDomainInfoInfoEx);