From feb00fe7cc238a78b3832c116cb4634936597735 Mon Sep 17 00:00:00 2001
From: Matthias Dieter Wallnöfer <mdw@samba.org>
Date: Wed, 10 Nov 2010 16:05:16 +0100
Subject: s4:dsdb - proof against empty RDN values where expected

This should prevent crashes as pointed out on the mailing list.
---
 source4/dsdb/common/util.c                      |  5 +++++
 source4/dsdb/samdb/ldb_modules/objectclass.c    |  4 +++-
 source4/dsdb/samdb/ldb_modules/repl_meta_data.c |  8 ++++++++
 source4/dsdb/samdb/ldb_modules/samldb.c         | 13 ++++++++++++-
 4 files changed, 28 insertions(+), 2 deletions(-)

(limited to 'source4/dsdb')

diff --git a/source4/dsdb/common/util.c b/source4/dsdb/common/util.c
index 04d97043b2..7f6ce64180 100644
--- a/source4/dsdb/common/util.c
+++ b/source4/dsdb/common/util.c
@@ -1595,7 +1595,12 @@ int samdb_find_site_for_computer(struct ldb_context *ldb,
 		talloc_free(dn);
 		return LDB_ERR_INVALID_DN_SYNTAX;
 	}
+
 	rdn_val = ldb_dn_get_rdn_val(dn);
+	if (rdn_val == NULL) {
+		return LDB_ERR_OPERATIONS_ERROR;
+	}
+
 	(*site_name) = talloc_strndup(mem_ctx, (const char *)rdn_val->data, rdn_val->length);
 	talloc_free(dn);
 	if (!*site_name) {
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index 811bc96f02..2e95eb5e91 100644
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -334,8 +334,10 @@ static int fix_dn(struct ldb_context *ldb,
 		return ldb_operr(ldb);
 	}
 
-
 	rdn_val = ldb_dn_get_rdn_val(newdn);
+	if (rdn_val == NULL) {
+		return ldb_operr(ldb);
+	}
 
 #if 0
 	/* the rules for rDN length constraints are more complex than
diff --git a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
index 7838b65fdf..b2d5292a14 100644
--- a/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
+++ b/source4/dsdb/samdb/ldb_modules/repl_meta_data.c
@@ -2561,6 +2561,10 @@ static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
 
 	rdn_name = ldb_dn_get_rdn_name(old_dn);
 	rdn_value = ldb_dn_get_rdn_val(old_dn);
+	if ((rdn_name == NULL) || (rdn_value == NULL)) {
+		talloc_free(tmp_ctx);
+		return ldb_operr(ldb);
+	}
 
 	msg = ldb_msg_new(tmp_ctx);
 	if (msg == NULL) {
@@ -2753,6 +2757,10 @@ static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
 		/* work out what the new rdn value is, for updating the
 		   rDN and name fields */
 		new_rdn_value = ldb_dn_get_rdn_val(new_dn);
+		if (new_rdn_value == NULL) {
+			talloc_free(tmp_ctx);
+			return ldb_operr(ldb);
+		}
 
 		sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
 		if (!sa) {
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 04b8dff0e0..1ac86148e6 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -575,6 +575,9 @@ static int samldb_fill_object(struct samldb_ctx *ac)
 		}
 
 		rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+		if (rdn_value == NULL) {
+			return ldb_operr(ldb);
+		}
 		if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
 			/* the RDN has prefix "CN" */
 			ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
@@ -638,6 +641,9 @@ static int samldb_fill_object(struct samldb_ctx *ac)
 	} else if (strcmp(ac->type, "attributeSchema") == 0) {
 		const struct ldb_val *rdn_value;
 		rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+		if (rdn_value == NULL) {
+			return ldb_operr(ldb);
+		}
 		if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
 			/* the RDN has prefix "CN" */
 			ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
@@ -692,6 +698,7 @@ static int samldb_fill_object(struct samldb_ctx *ac)
 static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac)
 {
 	struct ldb_context *ldb;
+	const struct ldb_val *rdn_value;
 	struct dom_sid *sid;
 	int ret;
 
@@ -699,8 +706,12 @@ static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac)
 
 	sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid");
 	if (sid == NULL) {
+		rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+		if (rdn_value == NULL) {
+			return ldb_operr(ldb);
+		}
 		sid = dom_sid_parse_talloc(ac->msg,
-					   (const char *)ldb_dn_get_rdn_val(ac->msg->dn)->data);
+					   (const char *)rdn_value->data);
 		if (sid == NULL) {
 			ldb_set_errstring(ldb,
 					  "samldb: No valid SID found in ForeignSecurityPrincipal CN!");
-- 
cgit