CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls
authorAndrew Bartlett <abartlet@samba.org>
Fri, 5 Jun 2020 10:14:48 +0000 (22:14 +1200)
committerKarolin Seeger <kseeger@samba.org>
Tue, 30 Jun 2020 10:52:13 +0000 (12:52 +0200)
commit4def2dc554754033174c60f5860f51b46d8502c1
treeaa97c461e194784df792a93f96d8326e702b0746
parent153c8db09b26455aa9802ff95943dd8a75f31893
CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls

Otherwise a paged search on the GC port will fail as the ->data was
not kept around for the second page of searches.

An example command to produce this is
 bin/ldbsearch --paged -H ldap://$SERVER:3268 -U$USERNAME%$PASSWORD

This shows up later in the partition module as:

ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00151ef20 at pc 0x7fec3f801aac bp 0x7ffe8472c270 sp 0x7ffe8472c260
READ of size 4 at 0x60b00151ef20 thread T0 (ldap(0))
    #0 0x7fec3f801aab in talloc_chunk_from_ptr ../../lib/talloc/talloc.c:526
    #1 0x7fec3f801aab in __talloc_get_name ../../lib/talloc/talloc.c:1559
    #2 0x7fec3f801aab in talloc_check_name ../../lib/talloc/talloc.c:1582
    #3 0x7fec1b86b2e1 in partition_search ../../source4/dsdb/samdb/ldb_modules/partition.c:780

or

smb_panic_default: PANIC (pid 13287): Bad talloc magic value - unknown value
(from source4/dsdb/samdb/ldb_modules/partition.c:780)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14402

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
source4/dsdb/samdb/ldb_modules/paged_results.c
source4/dsdb/samdb/ldb_modules/vlv_pagination.c