s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value

Fix use after free detected by AddressSanitizer

AddressSanitizer: heap-use-after-free on address 0x61400026a4a0
                  at pc 0x7fd555c52f12 bp 0x7ffed7231180 sp 0x7ffed7231170
                  READ of size 1 at 0x61400026a4a0 thread T0
    #0 0x7fd555c52f11 in ldb_should_b64_encode
       ../../lib/ldb/common/ldb_ldif.c:197
    #1 0x7fd539dc9417 in dsdb_audit_add_ldb_value
       ../../source4/dsdb/samdb/ldb_modules/audit_util.c:491
    #2 0x7fd539dc9417 in dsdb_audit_attributes_json
       ../../source4/dsdb/samdb/ldb_modules/audit_util.c:651
    #3 0x7fd539dc6a7e in operation_json
       ../../source4/dsdb/samdb/ldb_modules/audit_log.c:305

The problem is that at the successful end of these functions
el->values is overwritten with new_values.  However get_parsed_dns()
points p->v at the supplied el and it effectively gets used
as a working area by replmd_build_la_val().  So we must duplicate it
because our caller only called ldb_msg_copy_shallow().

The reason this matters is that the audit_log module is
above repl_meta_data in the stack, and tries to log the
ldb_message it saw after the reply (to include the error code).
If that ldb_message is changed it is not only misleading,
it can point to memory that has since gone away.

In this case the memory for the full extended DN in the
member attribute ended up on 'ac', a context lost by
the time repl_meta_data has finished processing.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13941

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed May 15 05:35:47 UTC 2019 on sn-devel-184

(cherry picked from commit 0daa0ff9)
17 jobs for gary-bug-13941-v4-9 in 264 minutes and 23 seconds (queued for 2 seconds)
Status Name Job ID Coverage
  Build
passed build_ctdb #214034664
docker shared

00:23:23

passed build_others #214034668
docker shared

00:15:00

passed build_samba #214116638
docker private

03:20:17

passed build_samba_ad_dc #214034675
docker private

01:03:56

passed build_samba_ad_dc_2 #214034661
docker shared

00:23:49

passed build_samba_ctdb #214034666
docker shared

00:41:13

passed build_samba_fileserver #214034673
docker private

00:16:45

passed build_samba_libs #214034662
docker shared

00:21:33

passed build_samba_none_env #214034656
docker shared

00:46:38

passed build_samba_nopython #214034657
docker shared

00:16:52

passed build_samba_nt4 #214034672
docker private

00:39:05

passed build_samba_o3 #214034660
docker shared

00:19:12

passed build_samba_static #214034663
docker shared

00:21:38

passed build_samba_systemkrb5 #214034658
docker shared

00:11:06

passed build_samba_xc #214034659
docker shared

00:07:37

failed build_samba #214034671
private docker

02:02:37

failed build_samba #214088864
private docker

01:33:31