Attachment 10932 Details for Bug 11186 – New test patch for master

[patch] New test patch for master

0001-s3-libsmbclient-After-getting-attribute-server-ensur.patch (text/plain), 2.39 KB, created by Jeremy Allison on 2015-04-03 16:34:39 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2015-04-03 16:34:39 UTC

Size: 2.39 KB

patch

obsolete

>From 511f1ae4982e39d8e456df7e01ac2dc5a62acebd Mon Sep 17 00:00:00 2001
>From: Jeremy Allison <jra@samba.org>
>Date: Tue, 31 Mar 2015 14:40:23 -0700
>Subject: [PATCH] s3: libsmbclient: After getting attribute server, ensure main
> srv pointer is still valid.
>
>Bug #11186: Crash seen in libsmbclient due to free of server structure during SMBC_getxattr() call
>
>https://bugzilla.samba.org/show_bug.cgi?id=11186
>
>Signed-off-by: Jeremy Allison <jra@samba.org>
>---
> source3/libsmb/libsmb_xattr.c | 41 +++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 41 insertions(+)
>
>diff --git a/source3/libsmb/libsmb_xattr.c b/source3/libsmb/libsmb_xattr.c
>index 8493776..9f7bea8 100644
>--- a/source3/libsmb/libsmb_xattr.c
>+++ b/source3/libsmb/libsmb_xattr.c
>@@ -2073,6 +2073,25 @@ SMBC_getxattr_ctx(SMBCCTX *context,
>         if (! srv->no_nt_session) {
>                 ipc_srv = SMBC_attr_server(frame, context, server, port, share,
>                                            &workgroup, &user, &password);
>+		/*
>+		 * SMBC_attr_server() can cause the original
>+		 * server to be removed from the cache.
>+		 * If so we must error out here as the srv
>+		 * pointer has been freed.
>+		 */
>+		if (smbc_getFunctionGetCachedServer(context)(context,
>+				server,
>+				share,
>+				workgroup,
>+				user) != srv) {
>+#if defined(ECONNRESET)
>+			errno = ECONNRESET;
>+#else
>+			errno = ETIMEDOUT;
>+#endif
>+			TALLOC_FREE(frame);
>+			return -1;
>+		}
>                 if (! ipc_srv) {
>                         srv->no_nt_session = True;
>                 }
>@@ -2208,9 +2227,31 @@ SMBC_removexattr_ctx(SMBCCTX *context,
>         }
> 
>         if (! srv->no_nt_session) {
>+		int saved_errno;
>                 ipc_srv = SMBC_attr_server(frame, context, server, port, share,
>                                            &workgroup, &user, &password);
>+		saved_errno = errno;
>+		/*
>+		 * SMBC_attr_server() can cause the original
>+		 * server to be removed from the cache.
>+		 * If so we must error out here as the srv
>+		 * pointer has been freed.
>+		 */
>+		if (smbc_getFunctionGetCachedServer(context)(context,
>+				server,
>+				share,
>+				workgroup,
>+				user) != srv) {
>+#if defined(ECONNRESET)
>+			errno = ECONNRESET;
>+#else
>+			errno = ETIMEDOUT;
>+#endif
>+			TALLOC_FREE(frame);
>+			return -1;
>+		}
>                 if (! ipc_srv) {
>+			errno = saved_errno;
>                         srv->no_nt_session = True;
>                 }
>         } else {
>-- 
>2.2.0.rc0.207.ga3a616c
>

Actions: View

Attachments on bug 11186: 10924 | 10932 | 10953