Attachment 14192 Details for Bug 13420 – backported patch for 4.8

[patch] backported patch for 4.8

0001-s4-lsa-Fix-use-after-free-in-LSA-server.patch (text/plain), 1.66 KB, created by Andrew Bartlett on 2018-05-10 02:24:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andrew Bartlett

Created: 2018-05-10 02:24:32 UTC

Size: 1.66 KB

patch

obsolete

>From be5e2ff99d2cc7e3b6dfb6d44453345bf64559cd Mon Sep 17 00:00:00 2001
>From: Andrew Bartlett <abartlet@samba.org>
>Date: Thu, 3 May 2018 16:22:19 +1200
>Subject: [PATCH] s4-lsa: Fix use-after-free in LSA server
>
>This is a regression introduced in ab7988aa2fd1a43f576a4b73a6893c61c7ef1957.
>
>The state variable contains the data to be returned to the client
>and packed into NDR after the function returned.
>
>This memory needs to be kept (on mem_ctx as parent) until that is
>pushed and freed by the caller.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=13420
>
>Signed-off-by: Andrew Bartlett <abartlet@samba.org>
>Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
>(cherry picked from commit 7e091e505156381e385235ab4518b4d133a98497)
>---
> source4/rpc_server/lsa/lsa_lookup.c | 3 ---
> 1 file changed, 3 deletions(-)
>
>diff --git a/source4/rpc_server/lsa/lsa_lookup.c b/source4/rpc_server/lsa/lsa_lookup.c
>index 3baff1ec11f..1b6a7d2e5a7 100644
>--- a/source4/rpc_server/lsa/lsa_lookup.c
>+++ b/source4/rpc_server/lsa/lsa_lookup.c
>@@ -805,7 +805,6 @@ NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *m
> 
> 	state->r.out.result = status;
> 	dcesrv_lsa_LookupSids_base_map(state);
>-	TALLOC_FREE(state);
> 	return status;
> }
> 
>@@ -1284,7 +1283,6 @@ NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
> 
> 	state->r.out.result = status;
> 	dcesrv_lsa_LookupNames_base_map(state);
>-	TALLOC_FREE(state);
> 	return status;
> }
> 
>@@ -1357,7 +1355,6 @@ NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX
> 
> 	state->r.out.result = status;
> 	dcesrv_lsa_LookupNames_base_map(state);
>-	TALLOC_FREE(state);
> 	return status;
> }
> 
>-- 
>2.11.0
>

Flags:

metze: review-

Actions: View

Attachments on bug 13420: 14172 | 14174 | 14192 | 14195 | 14196 | 14198