s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value

Fix use after free detected by AddressSanitizer

AddressSanitizer: heap-use-after-free on address 0x61400026a4a0
                  at pc 0x7fd555c52f12 bp 0x7ffed7231180 sp 0x7ffed7231170
                  READ of size 1 at 0x61400026a4a0 thread T0
    #0 0x7fd555c52f11 in ldb_should_b64_encode
       ../../lib/ldb/common/ldb_ldif.c:197
    #1 0x7fd539dc9417 in dsdb_audit_add_ldb_value
       ../../source4/dsdb/samdb/ldb_modules/audit_util.c:491
    #2 0x7fd539dc9417 in dsdb_audit_attributes_json
       ../../source4/dsdb/samdb/ldb_modules/audit_util.c:651
    #3 0x7fd539dc6a7e in operation_json
       ../../source4/dsdb/samdb/ldb_modules/audit_log.c:305

The problem is that at the successful end of these functions
el->values is overwritten with new_values.  However get_parsed_dns()
points p->v at the supplied el and it effectively gets used
as a working area by replmd_build_la_val().  So we must duplicate it
because our caller only called ldb_msg_copy_shallow().

The reason this matters is that the audit_log module is
above repl_meta_data in the stack, and tries to log the
ldb_message it saw after the reply (to include the error code).
If that ldb_message is changed it is not only misleading,
it can point to memory that has since gone away.

In this case the memory for the full extended DN in the
member attribute ended up on 'ac', a context lost by
the time repl_meta_data has finished processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13941

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed May 15 05:35:47 UTC 2019 on sn-devel-184

(cherry picked from commit 0daa0ff9)
24 jobs for gary-bug-13941 in 386 minutes and 12 seconds (queued for 2 seconds)
Status Name Job ID Coverage
  Build
passed build_ctdb #213260328
docker shared

00:36:17

passed build_others #213260332
docker shared

00:12:36

passed build_samba #213347074
docker private

05:13:01

passed build_samba_ad_dc #213260338
docker private

01:13:07

passed build_samba_ad_dc_2 #213260316
docker shared

00:31:20

passed build_samba_ad_dc_2_py2 #213260320
docker shared

00:17:01

passed build_samba_ad_dc_backup #213260317
docker shared

00:31:02

passed build_samba_ad_dc_backup_py2 #213260318
docker shared

00:14:07

passed build_samba_ad_dc_py2 #213260339
docker private

00:15:50

passed build_samba_buildpy2_only #213260333
docker shared

00:17:08

passed build_samba_ctdb #213260329
docker shared

00:19:17

passed build_samba_fileserver #213260337
docker private

00:18:50

passed build_samba_libs #213260323
docker shared

00:30:55

passed build_samba_libs_py2 #213260325
docker shared

00:31:35

passed build_samba_none_env #213260309
docker shared

00:47:02

passed build_samba_none_env_py2 #213260310
docker shared

00:24:06

passed build_samba_nopython #213260312
docker shared

00:25:54

passed build_samba_o3 #213260315
docker shared

00:32:23

passed build_samba_py2 #213260336
docker private

01:10:26

passed build_samba_static #213260326
docker shared

00:17:16

passed build_samba_systemkrb5 #213260313
docker shared

00:13:39

passed build_samba_xc #213260314
docker shared

00:04:58

failed build_samba #213260334
docker private

02:29:32

failed build_samba #213309443
private docker

02:34:28