CVE-2015-3223: lib: ldb: Use memmem binary search, not strstr text search.

Values might have embedded zeros.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11325

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>

diff --git a/lib/ldb/common/ldb_match.c b/lib/ldb/common/ldb_match.c
index 7414289b613195cf0ae171794927e930aa7ab0ff..182c6ce5720fe54f7c5a8297cb05169f57be0243 100644 (file)
--- a/lib/ldb/common/ldb_match.c
+++ b/lib/ldb/common/ldb_match.c
@@ -241,7 +241,6 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
        struct ldb_val val;
        struct ldb_val cnk;
        struct ldb_val *chunk;
-       char *p, *g;
        uint8_t *save_p = NULL;
        unsigned int c = 0;
 
@@ -288,6 +287,7 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
        }
 
        while (tree->u.substring.chunks[c]) {
+               uint8_t *p;
 
                chunk = tree->u.substring.chunks[c];
                if(a->syntax->canonicalise_fn(ldb, ldb, chunk, &cnk) != 0) goto mismatch;
@@ -299,15 +299,24 @@ static int ldb_wildcard_compare(struct ldb_context *ldb,
                if (cnk.length == 0) {
                        goto mismatch;
                }
-               p = strstr((char *)val.data, (char *)cnk.data);
+               /*
+                * Values might be binary blobs. Don't use string
+                * search, but memory search instead.
+                */
+               p = memmem((const void *)val.data,val.length,
+                          (const void *)cnk.data, cnk.length);
                if (p == NULL) goto mismatch;
                if ( (! tree->u.substring.chunks[c + 1]) && (! tree->u.substring.end_with_wildcard) ) {
+                       uint8_t *g;
                        do { /* greedy */
-                               g = strstr((char *)p + cnk.length, (char *)cnk.data);
+                               g = memmem(p + cnk.length,
+                                       val.length - (p - val.data),
+                                       (const uint8_t *)cnk.data,
+                                       cnk.length);
                                if (g) p = g;
                        } while(g);
                }
-               val.length = val.length - (p - (char *)(val.data)) - cnk.length;
+               val.length = val.length - (p - (uint8_t *)(val.data)) - cnk.length;
                val.data = (uint8_t *)(p + cnk.length);
                c++;
                talloc_free(cnk.data);