CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls
authorAndrew Bartlett <abartlet@samba.org>
Fri, 5 Jun 2020 10:14:48 +0000 (22:14 +1200)
committerKarolin Seeger <kseeger@samba.org>
Thu, 2 Jul 2020 09:01:41 +0000 (09:01 +0000)
commit32c333def9ad5a1c67abee320cf5f3c4f2cb1e5c
treecdb773adc04c04a958407ca594f4386ae139bfdf
parentcc3a67760cf9faaad3af73b1eed9e2ef85276633
CVE-2020-10760 dsdb: Ensure a proper talloc tree for saved controls

Otherwise a paged search on the GC port will fail as the ->data was
not kept around for the second page of searches.

An example command to produce this is
 bin/ldbsearch --paged -H ldap://$SERVER:3268 -U$USERNAME%$PASSWORD

This shows up later in the partition module as:

ERROR: AddressSanitizer: heap-use-after-free on address 0x60b00151ef20 at pc 0x7fec3f801aac bp 0x7ffe8472c270 sp 0x7ffe8472c260
READ of size 4 at 0x60b00151ef20 thread T0 (ldap(0))
    #0 0x7fec3f801aab in talloc_chunk_from_ptr ../../lib/talloc/talloc.c:526
    #1 0x7fec3f801aab in __talloc_get_name ../../lib/talloc/talloc.c:1559
    #2 0x7fec3f801aab in talloc_check_name ../../lib/talloc/talloc.c:1582
    #3 0x7fec1b86b2e1 in partition_search ../../source4/dsdb/samdb/ldb_modules/partition.c:780

or

smb_panic_default: PANIC (pid 13287): Bad talloc magic value - unknown value
(from source4/dsdb/samdb/ldb_modules/partition.c:780)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14402

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
source4/dsdb/samdb/ldb_modules/paged_results.c
source4/dsdb/samdb/ldb_modules/vlv_pagination.c