CVE-2019-3824 ldb: wildcard_match check tree operation

Check the operation type of the passed parse tree, and return
LDB_INAPPROPRIATE_MATCH if the operation is not LDB_OP_SUBSTRING.

A query of "attribute=*" gets parsed as LDB_OP_PRESENT, checking the
operation and failing ldb_wildcard_match should help prevent confusion
writing tests.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13773

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/lib/ldb/common/ldb_match.c b/lib/ldb/common/ldb_match.c
index ab0a89888f0dccccd5d3f14564c2df5987a42032..59f48b52b70449781f2073649e4bd616fa296cad 100644 (file)
--- a/lib/ldb/common/ldb_match.c
+++ b/lib/ldb/common/ldb_match.c
@@ -244,6 +244,11 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
        uint8_t *save_p = NULL;
        unsigned int c = 0;
 
+       if (tree->operation != LDB_OP_SUBSTRING) {
+               *matched = false;
+               return LDB_ERR_INAPPROPRIATE_MATCHING;
+       }
+
        a = ldb_schema_attribute_by_name(ldb, tree->u.substring.attr);
        if (!a) {
                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;