CVE-2019-3824 ldb: wildcard_match end of data check

ldb_handler_copy and ldb_val_dup over allocate by one and add a trailing '\0'
to the data, to make them safe to use the C string functions on.

However testing for the trailing '\0' is not the correct way to test for
the end of a value, the length should be checked instead.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

diff --git a/lib/ldb/common/ldb_match.c b/lib/ldb/common/ldb_match.c
index 5326b0090777f48c381d841654f79d79fe4299da..af61de52e272b26ac02d1a83d0fe8d1ddefd64cd 100644 (file)
--- a/lib/ldb/common/ldb_match.c
+++ b/lib/ldb/common/ldb_match.c
@@ -353,7 +353,7 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
        }
 
        /* last chunk may not have reached end of string */
-       if ( (! tree->u.substring.end_with_wildcard) && (*(val.data) != 0) ) goto mismatch;
+       if ( (! tree->u.substring.end_with_wildcard) && (val.length != 0) ) goto mismatch;
        talloc_free(save_p);
        *matched = true;
        return LDB_SUCCESS;