Created attachment 17344 [details]
patch for these bugs for master under CI

Created attachment 17376 [details]
patches for these bugs for master

Created attachment 17380 [details]
patches for master v3

Included some more fixes for incorrect flag comparisons.

Created attachment 17382 [details]
patches v3 for 4.16

Created attachment 17383 [details]
patches v3 for 4.15

Created attachment 17384 [details]
patches v3 for 4.14

Created attachment 17385 [details]
patches v3 for 4.12

Applies on top of 4.12 patches for #14725.

(In reply to Joseph Sutton from comment #6)

Hi Joseph, sorry for the unrelated spam on this bug, but can you explain to me how you're getting a 4.14 build to pass autobuild please ?

I'm trying to do this for:

https://bugzilla.samba.org/show_bug.cgi?id=15085

(CVE-2022-32742) and my private autobuilds fail with a -Werror=format-truncation problem that's unrelated to my code changes.

==> samba.stderr <==
../lib/replace/test/testsuite.c: In function ‘test_snprintf’:
../lib/replace/test/testsuite.c:355:6: error: ‘%d’ directive output truncated writing 1 byte into a region of size 0 [-Werror=format-truncation=]
  if (snprintf(tmp, 3, "foo%d", 9) != 4) {
      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
../lib/replace/test/testsuite.c:355:6: note: ‘snprintf’ output 5 bytes into a destination of size 3

I must be setting up something wrong but I don't see what ?

(In reply to Jeremy Allison from comment #8)
Hi, are you referring to the autobuilds on samba.org? I'm afraid I don't know what's going on there; I've just been running private pipelines for these patchsets on our private GitLab.

(In reply to Joseph Sutton from comment #9)

Sorry for spamming the bug. Yes these are autobuilds on samba.org. I'm guessing as they're not containerized an OS update / compiler update changes the patches required for build.

I'll see if I can get the 4.14.next through the catalyst build system instead.

This comment on ldb_msg_append_linearized_dn() is incorrect

+/*
+  append a DN element to a message
+  WARNING: this uses the linearized string from the dn, and does not
+  copy the string.
+*/

It does an allocation in ldb_dn_alloc_linearized() and puts the allocated memory in the correct place with talloc_steal(), which is exactly what we want.


In samdb_msg_add_int_flags() and samdb_msg_add_uint_flags() the poor pattern that this patch set complains about is repeated.  Both the new and original should use the new _steal functions and not take a memory context, allocating the string version of the 'int' somewhere (eg samdb) and stealing to the right spot.

Comment on attachment 17380 [details]
patches for master v3

Despite my comments I've decided to mark this as reviewed, and we can fix this up more once in master.  The two issues are just echos of the existing state, and the security patch does the minimal change (even to the extent of copying an incorrect comment from where it was already incorrect).

Assigning to Jule for the next security release.

Opening security bugs to vendors.  Release date is currently proposed to be Wednesday 27 July but bug 15109 will be the authoritative reference on that.

Created attachment 17435 [details]
patches v3 for 4.10

Before applying these patches, first apply the 4.10 patches for:
https://bugzilla.samba.org/show_bug.cgi?id=14725

Comment on attachment 17435 [details]
patches v3 for 4.10

The 4.10 backport looks good to me.  Note that the new ldb 'release' in the 4.10 backport has an un-official version of 1.5.9, not released upstream (the same applies to the 4.12 backport). 

The only check I've not done is that some other area of the code is not using the ldb element flags improperly (eg I've checked the backport, not the rest of Samba).

Created attachment 17448 [details]
patches v3 for 4.13

Removing vendor CC (so that any public comments don't need to be broadcast so widely) and opening these bugs to the public.
If you wish to continue to be informed about any changes here please CC individually.

(In reply to Andrew Bartlett from comment #16)
To be clear, this means that after patching, the Samba tarball contains the new un-official ldb versions.  tarballs could be produced by running 'make dist' in lib/ldb if so required by your packaging.

Pushed to all relevant branches. Closing out bug report.
Many thanks at all!