Attachment 10853 Details for Bug 49593

[patch] bug49593-idea2.diff

bug49593-idea2.diff (text/plain), 1.09 KB, created by Arvid Requate on 2021-11-04 14:20 CET

(hide)

Description:

Filename:

MIME Type:

Creator: Arvid Requate

Created: 2021-11-04 14:20 CET

Size: 1.09 KB

patch

obsolete

>diff --git a/source4/dsdb/samdb/ldb_modules/util.c b/source4/dsdb/samdb/ldb_modules/util.c
>index ba1cfff..999f757 100644
>--- a/source4/dsdb/samdb/ldb_modules/util.c
>+++ b/source4/dsdb/samdb/ldb_modules/util.c
>@@ -1049,9 +1049,20 @@ again:
> bool dsdb_module_am_system(struct ldb_module *module)
> {
> 	struct ldb_context *ldb = ldb_module_get_ctx(module);
>+
>+	/* Debugging / mitigation for https://forge.univention.org/bugzilla/show_bug.cgi?id=49593 */
>+	const void *ptr = ldb_get_opaque(ldb, DSDB_SESSION_INFO);
>+        const char *pp = (const char *)ptr;
>+        struct talloc_chunk *tc = discard_const_p(struct talloc_chunk, pp - TC_HDR_SIZE);
>+        if (unlikely((tc->flags & (TALLOC_FLAG_FREE | ~TALLOC_FLAG_MASK)) != talloc_magic)) {
>+		talloc_log("Bad talloc magic value - unknown value");
>+		talloc_log("Invalid DSDB_SESSION_INFO in dsdb_module_am_system\n");
>+		return false;
>+	}
>+
> 	struct auth_session_info *session_info
> 		= talloc_get_type(
>-			ldb_get_opaque(ldb, DSDB_SESSION_INFO),
>+			ptr,
> 			struct auth_session_info);
> 	return security_session_user_level(session_info, NULL) == SECURITY_SYSTEM;
> }

Actions: View | Diff

Attachments on bug 49593: 10853