From 8cf6c358e27a3926397e0d5fbb562e76926589d9 Mon Sep 17 00:00:00 2001
From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Thu, 16 Feb 2023 12:35:34 +1300
Subject: [PATCH 26/34] CVE-2023-0614 ldb: Use binary search to check whether
 attribute is secret

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15270

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Conflict: NA
Reference: https://attachments.samba.org/attachment.cgi?id=17821
---
 source4/dsdb/samdb/ldb_modules/acl_read.c | 56 ++++++++++++++---------
 1 file changed, 35 insertions(+), 21 deletions(-)

diff --git a/source4/dsdb/samdb/ldb_modules/acl_read.c b/source4/dsdb/samdb/ldb_modules/acl_read.c
index 6dcc3c9b36e..21f72fbe720 100644
--- a/source4/dsdb/samdb/ldb_modules/acl_read.c
+++ b/source4/dsdb/samdb/ldb_modules/acl_read.c
@@ -79,6 +79,7 @@ struct aclread_private {
 	struct security_descriptor *sd_cached;
 	struct ldb_val sd_cached_blob;
 	const char **password_attrs;
+	size_t num_password_attrs;
 };
 
 struct access_check_context {
@@ -512,22 +513,18 @@ static int aclread_get_sd_from_ldb_message(struct aclread_context *ac,
 /* Check whether the attribute is a password attribute. */
 static bool attr_is_secret(const char *attr, const struct aclread_private *private_data)
 {
-	unsigned i;
+	const char **found = NULL;
 
 	if (private_data->password_attrs == NULL) {
 		return false;
 	}
 
-	for (i = 0; private_data->password_attrs[i] != NULL; ++i) {
-		const char *password_attr = private_data->password_attrs[i];
-		if (ldb_attr_cmp(attr, password_attr) != 0) {
-			continue;
-		}
-
-		return true;
-	}
-
-	return false;
+	BINARY_ARRAY_SEARCH_V(private_data->password_attrs,
+			      private_data->num_password_attrs,
+			      attr,
+			      ldb_attr_cmp,
+			      found);
+	return found != NULL;
 }
 
 /*
@@ -1128,6 +1125,14 @@ static int acl_redact_msg_for_filter(struct ldb_module *module, struct ldb_reque
 	return LDB_SUCCESS;
 }
 
+static int ldb_attr_cmp_fn(const void *_a, const void *_b)
+{
+	const char * const *a = _a;
+	const char * const *b = _b;
+
+	return ldb_attr_cmp(*a, *b);
+}
+
 static int aclread_init(struct ldb_module *module)
 {
 	struct ldb_context *ldb = ldb_module_get_ctx(module);
@@ -1188,7 +1193,7 @@ static int aclread_init(struct ldb_module *module)
 	}
 	p->password_attrs = talloc_array(p, const char *,
 			password_attributes->num_values +
-			ARRAY_SIZE(secret_attrs) + 1);
+			ARRAY_SIZE(secret_attrs));
 	if (!p->password_attrs) {
 		talloc_free(mem_ctx);
 		return ldb_oom(ldb);
@@ -1223,7 +1228,10 @@ static int aclread_init(struct ldb_module *module)
 		}
 		n++;
 	}
-	p->password_attrs[n] = NULL;
+	p->num_password_attrs = n;
+
+	/* Sort the password attributes so we can use binary search. */
+	TYPESAFE_QSORT(p->password_attrs, p->num_password_attrs, ldb_attr_cmp_fn);
 
 	ret = ldb_register_redact_callback(ldb, acl_redact_msg_for_filter, module);
 	if (ret != LDB_SUCCESS) {
@@ -1247,19 +1255,25 @@ done:
 								  module,
 								  NULL);
 		if (!userPassword_support) {
+			const char **found = NULL;
+
 			/*
 			 * Remove the userPassword attribute, as it is not
 			 * considered secret.
 			 */
-			for (i = 0; p->password_attrs[i] != NULL; ++i) {
-				if (ldb_attr_cmp(p->password_attrs[i], "userPassword") == 0) {
-					break;
+			BINARY_ARRAY_SEARCH_V(p->password_attrs,
+					      p->num_password_attrs,
+					      "userPassword",
+					      ldb_attr_cmp,
+					      found);
+			if (found != NULL) {
+				size_t found_idx = found - p->password_attrs;
+
+				/* Shift following elements backwards by one. */
+				for (i = found_idx; i < p->num_password_attrs - 1; ++i) {
+					p->password_attrs[i] = p->password_attrs[i + 1];
 				}
-			}
-
-			/* Shift following elements backwards by one. */
-			for (; p->password_attrs[i] != NULL; ++i) {
-				p->password_attrs[i] = p->password_attrs[i + 1];
+				--p->num_password_attrs;
 			}
 		}
 	}
-- 
2.25.1