From d816eb947f2862dc7488dc538172c78926e3f16a Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 14 Oct 2022 10:03:17 +0100 Subject: [PATCH 1/9] s3/rpcclient: Duplicate string returned from poptGetArg popt1.19 fixes a leak that exposes a use as free, make sure we duplicate return of poptGetArg if poptFreeContext is called before we use it. ==4407== Invalid read of size 1 ==4407== at 0x146263: main (rpcclient.c:1262) ==4407== Address 0x7b67cd0 is 0 bytes inside a block of size 10 free'd ==4407== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B2E8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x5B2F5D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x146227: main (rpcclient.c:1251) ==4407== Block was alloc'd at ==4407== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B302EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x1461BC: main (rpcclient.c:1219) ==4407== ==4407== Invalid read of size 1 ==4407== at 0x14627D: main (rpcclient.c:1263) ==4407== Address 0x7b67cd0 is 0 bytes inside a block of size 10 free'd ==4407== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B2E8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x5B2F5D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x146227: main (rpcclient.c:1251) ==4407== Block was alloc'd at ==4407== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B302EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x1461BC: main (rpcclient.c:1219) ==4407== ==4407== Invalid read of size 1 ==4407== at 0x4849782: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x4980E1C: talloc_strdup (talloc.c:2470) ==4407== by 0x488CD96: dcerpc_parse_binding (binding.c:320) ==4407== by 0x1462B1: main (rpcclient.c:1267) ==4407== Address 0x7b67cd0 is 0 bytes inside a block of size 10 free'd ==4407== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B2E8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x5B2F5D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x146227: main (rpcclient.c:1251) ==4407== Block was alloc'd at ==4407== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B302EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x1461BC: main (rpcclient.c:1219) ==4407== ==4407== Invalid read of size 1 ==4407== at 0x4849794: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x4980E1C: talloc_strdup (talloc.c:2470) ==4407== by 0x488CD96: dcerpc_parse_binding (binding.c:320) ==4407== by 0x1462B1: main (rpcclient.c:1267) ==4407== Address 0x7b67cd1 is 1 bytes inside a block of size 10 free'd ==4407== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B2E8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x5B2F5D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x146227: main (rpcclient.c:1251) ==4407== Block was alloc'd at ==4407== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B302EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x1461BC: main (rpcclient.c:1219) ==4407== ==4407== Invalid read of size 8 ==4407== at 0x484D3AE: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x4980DC2: __talloc_strlendup (talloc.c:2457) ==4407== by 0x4980E32: talloc_strdup (talloc.c:2470) ==4407== by 0x488CD96: dcerpc_parse_binding (binding.c:320) ==4407== by 0x1462B1: main (rpcclient.c:1267) ==4407== Address 0x7b67cd0 is 0 bytes inside a block of size 10 free'd ==4407== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B2E8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x5B2F5D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x146227: main (rpcclient.c:1251) ==4407== Block was alloc'd at ==4407== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B302EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x1461BC: main (rpcclient.c:1219) ==4407== ==4407== Invalid read of size 1 ==4407== at 0x484D430: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x4980DC2: __talloc_strlendup (talloc.c:2457) ==4407== by 0x4980E32: talloc_strdup (talloc.c:2470) ==4407== by 0x488CD96: dcerpc_parse_binding (binding.c:320) ==4407== by 0x1462B1: main (rpcclient.c:1267) ==4407== Address 0x7b67cd8 is 8 bytes inside a block of size 10 free'd ==4407== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B2E8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x5B2F5D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x146227: main (rpcclient.c:1251) ==4407== Block was alloc'd at ==4407== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==4407== by 0x5B302EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==4407== by 0x1461BC: main (rpcclient.c:1219) BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Ralph Boehme (cherry picked from commit d26d3d9bff61f796c9c9ab54990ea078f575ab1e) --- source3/rpcclient/rpcclient.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c index 4042d0d60be..27fe5d705c6 100644 --- a/source3/rpcclient/rpcclient.c +++ b/source3/rpcclient/rpcclient.c @@ -1238,7 +1238,7 @@ out_free: /* Get server as remaining unparsed argument. Print usage if more than one unparsed argument is present. */ - server = poptGetArg(pc); + server = talloc_strdup(frame, poptGetArg(pc)); if (!server || poptGetArg(pc)) { poptPrintHelp(pc, stderr, 0); -- 2.38.0 From 67ec7cd1474d07e799e9e02596152239934f3f98 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 14 Oct 2022 11:23:37 +0100 Subject: [PATCH 2/9] s3/param: Fix use after free with popt-1.19 popt1.19 fixes a leak that exposes a use as free, make sure we duplicate return of poptGetArg if poptFreeContext is called before we use it. ==5325== Invalid read of size 1 ==5325== at 0x4849782: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859E1C: talloc_strdup (talloc.c:2470) ==5325== by 0x48C0D37: talloc_sub_basic (substitute.c:303) ==5325== by 0x4894B98: lp_load_ex (loadparm.c:4004) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8b0 is 0 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 1 ==5325== at 0x4849794: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859E1C: talloc_strdup (talloc.c:2470) ==5325== by 0x48C0D37: talloc_sub_basic (substitute.c:303) ==5325== by 0x4894B98: lp_load_ex (loadparm.c:4004) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8b1 is 1 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 8 ==5325== at 0x484D3AE: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859DC2: __talloc_strlendup (talloc.c:2457) ==5325== by 0x4859E32: talloc_strdup (talloc.c:2470) ==5325== by 0x48C0D37: talloc_sub_basic (substitute.c:303) ==5325== by 0x4894B98: lp_load_ex (loadparm.c:4004) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8b0 is 0 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 2 ==5325== at 0x484D400: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859DC2: __talloc_strlendup (talloc.c:2457) ==5325== by 0x4859E32: talloc_strdup (talloc.c:2470) ==5325== by 0x48C0D37: talloc_sub_basic (substitute.c:303) ==5325== by 0x4894B98: lp_load_ex (loadparm.c:4004) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8c0 is 16 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 1 ==5325== at 0x484D430: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859DC2: __talloc_strlendup (talloc.c:2457) ==5325== by 0x4859E32: talloc_strdup (talloc.c:2470) ==5325== by 0x48C0D37: talloc_sub_basic (substitute.c:303) ==5325== by 0x4894B98: lp_load_ex (loadparm.c:4004) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8c2 is 18 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 1 ==5325== at 0x4849782: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859E1C: talloc_strdup (talloc.c:2470) ==5325== by 0x4B3B74B: add_to_file_list (loadparm.c:1023) ==5325== by 0x4894BD4: lp_load_ex (loadparm.c:4011) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8b0 is 0 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 1 ==5325== at 0x4849794: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859E1C: talloc_strdup (talloc.c:2470) ==5325== by 0x4B3B74B: add_to_file_list (loadparm.c:1023) ==5325== by 0x4894BD4: lp_load_ex (loadparm.c:4011) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8b1 is 1 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 8 ==5325== at 0x484D3AE: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859DC2: __talloc_strlendup (talloc.c:2457) ==5325== by 0x4859E32: talloc_strdup (talloc.c:2470) ==5325== by 0x4B3B74B: add_to_file_list (loadparm.c:1023) ==5325== by 0x4894BD4: lp_load_ex (loadparm.c:4011) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8b0 is 0 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 2 ==5325== at 0x484D400: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859DC2: __talloc_strlendup (talloc.c:2457) ==5325== by 0x4859E32: talloc_strdup (talloc.c:2470) ==5325== by 0x4B3B74B: add_to_file_list (loadparm.c:1023) ==5325== by 0x4894BD4: lp_load_ex (loadparm.c:4011) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8c0 is 16 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== ==5325== Invalid read of size 1 ==5325== at 0x484D430: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4859DC2: __talloc_strlendup (talloc.c:2457) ==5325== by 0x4859E32: talloc_strdup (talloc.c:2470) ==5325== by 0x4B3B74B: add_to_file_list (loadparm.c:1023) ==5325== by 0x4894BD4: lp_load_ex (loadparm.c:4011) ==5325== by 0x489529E: lp_load_with_registry_shares (loadparm.c:4237) ==5325== by 0x10ABD7: main (test_lp_load.c:98) ==5325== Address 0x72da8c2 is 18 bytes inside a block of size 20 free'd ==5325== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B8F8B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x4B905D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB8E: main (test_lp_load.c:90) ==5325== Block was alloc'd at ==5325== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5325== by 0x4B912EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5325== by 0x10AB49: main (test_lp_load.c:74) ==5325== BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Ralph Boehme (cherry picked from commit ff003fc87b8164610dfd6572347c05308c4b2fd7) --- source3/param/test_lp_load.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/param/test_lp_load.c b/source3/param/test_lp_load.c index 2c6a5c8891b..03be4118efd 100644 --- a/source3/param/test_lp_load.c +++ b/source3/param/test_lp_load.c @@ -82,7 +82,7 @@ int main(int argc, const char **argv) } if (poptPeekArg(pc)) { - config_file = poptGetArg(pc); + config_file = talloc_strdup(frame, poptGetArg(pc)); } else { config_file = get_dyn_CONFIGFILE(); } -- 2.38.0 From 9e1cf581f460c5f0b185fe064811a88ad83e39bd Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 14 Oct 2022 11:26:24 +0100 Subject: [PATCH 3/9] s3/utils: Add missing poptFreeContext BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Ralph Boehme (cherry picked from commit 31d3d10b260f05080ca0a3cf9434aa4704d60739) --- source3/utils/mdsearch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/source3/utils/mdsearch.c b/source3/utils/mdsearch.c index ac0b75fca51..ab48e366a0a 100644 --- a/source3/utils/mdsearch.c +++ b/source3/utils/mdsearch.c @@ -242,6 +242,7 @@ int main(int argc, char **argv) return 0; fail: + poptFreeContext(pc); TALLOC_FREE(frame); return 1; } -- 2.38.0 From 30b00f6c43f45ba9cdf38562d832193206877d64 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 14 Oct 2022 11:35:51 +0100 Subject: [PATCH 4/9] s3/utils: Fix use after free with popt 1.19 popt1.19 fixes a leak that exposes a use as free, make sure we duplicate return of poptGetArg if poptFreeContext is called before we use it. ==5914== Invalid read of size 1 ==5914== at 0x4FDF740: strlcpy (in /usr/lib64/libbsd.so.0.11.6) ==5914== by 0x49E09A9: tdbsam_getsampwnam (pdb_tdb.c:583) ==5914== by 0x49D94E5: pdb_getsampwnam (pdb_interface.c:340) ==5914== by 0x10DED1: print_user_info (pdbedit.c:372) ==5914== by 0x111413: main (pdbedit.c:1324) ==5914== Address 0x73b6750 is 0 bytes inside a block of size 7 free'd ==5914== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5914== by 0x4C508B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==5914== by 0x4C515D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==5914== by 0x1113E6: main (pdbedit.c:1323) ==5914== Block was alloc'd at ==5914== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==5914== by 0x4C522EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==5914== by 0x110AE5: main (pdbedit.c:1137) ==5914== BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Ralph Boehme (cherry picked from commit e82699fcca3716d9ed0450263fd83f948de8ffbe) --- source3/utils/pdbedit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/utils/pdbedit.c b/source3/utils/pdbedit.c index 4fdcc3ee428..eb4f3072df8 100644 --- a/source3/utils/pdbedit.c +++ b/source3/utils/pdbedit.c @@ -1150,7 +1150,7 @@ int main(int argc, const char **argv) poptGetArg(pc); /* Drop argv[0], the program name */ if (user_name == NULL) - user_name = poptGetArg(pc); + user_name = talloc_strdup(frame, poptGetArg(pc)); setparms = (backend ? BIT_BACKEND : 0) + (verbose ? BIT_VERBOSE : 0) + -- 2.38.0 From 70b9beb28672614059d51f4cb26842cfb27dfe2a Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 14 Oct 2022 11:45:13 +0100 Subject: [PATCH 5/9] s3/utils: Fix use after free with popt 1.19 popt1.19 fixes a leak that exposes a use as free, make sure we duplicate return of poptGetArg if poptFreeContext is called before we use it. ==6055== Command: ./bin/testparm /etc/samba/smb.conf ==6055== ==6055== Invalid read of size 1 ==6055== at 0x4849782: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4C1E50F: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6055== by 0x4C1EB74: buffered_vfprintf (in /usr/lib64/libc.so.6) ==6055== by 0x4C119E9: fprintf (in /usr/lib64/libc.so.6) ==6055== by 0x10EBFA: main (testparm.c:862) ==6055== Address 0x72dab70 is 0 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x4849794: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4C1E50F: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6055== by 0x4C1EB74: buffered_vfprintf (in /usr/lib64/libc.so.6) ==6055== by 0x4C119E9: fprintf (in /usr/lib64/libc.so.6) ==6055== by 0x10EBFA: main (testparm.c:862) ==6055== Address 0x72dab71 is 1 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x4C44DD0: _IO_default_xsputn (in /usr/lib64/libc.so.6) ==6055== by 0x4C1E39E: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6055== by 0x4C1EB74: buffered_vfprintf (in /usr/lib64/libc.so.6) ==6055== by 0x4C119E9: fprintf (in /usr/lib64/libc.so.6) ==6055== by 0x10EBFA: main (testparm.c:862) ==6055== Address 0x72dab70 is 0 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x4C44DDF: _IO_default_xsputn (in /usr/lib64/libc.so.6) ==6055== by 0x4C1E39E: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6055== by 0x4C1EB74: buffered_vfprintf (in /usr/lib64/libc.so.6) ==6055== by 0x4C119E9: fprintf (in /usr/lib64/libc.so.6) ==6055== by 0x10EBFA: main (testparm.c:862) ==6055== Address 0x72dab72 is 2 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== Load smb config files from /etc/samba/smb.conf ==6055== Invalid read of size 1 ==6055== at 0x4849782: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927E1C: talloc_strdup (talloc.c:2470) ==6055== by 0x48B5D37: talloc_sub_basic (substitute.c:303) ==6055== by 0x4889B98: lp_load_ex (loadparm.c:4004) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab70 is 0 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x4849794: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927E1C: talloc_strdup (talloc.c:2470) ==6055== by 0x48B5D37: talloc_sub_basic (substitute.c:303) ==6055== by 0x4889B98: lp_load_ex (loadparm.c:4004) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab71 is 1 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 8 ==6055== at 0x484D3AE: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927DC2: __talloc_strlendup (talloc.c:2457) ==6055== by 0x4927E32: talloc_strdup (talloc.c:2470) ==6055== by 0x48B5D37: talloc_sub_basic (substitute.c:303) ==6055== by 0x4889B98: lp_load_ex (loadparm.c:4004) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab70 is 0 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 2 ==6055== at 0x484D400: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927DC2: __talloc_strlendup (talloc.c:2457) ==6055== by 0x4927E32: talloc_strdup (talloc.c:2470) ==6055== by 0x48B5D37: talloc_sub_basic (substitute.c:303) ==6055== by 0x4889B98: lp_load_ex (loadparm.c:4004) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab80 is 16 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x484D430: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927DC2: __talloc_strlendup (talloc.c:2457) ==6055== by 0x4927E32: talloc_strdup (talloc.c:2470) ==6055== by 0x48B5D37: talloc_sub_basic (substitute.c:303) ==6055== by 0x4889B98: lp_load_ex (loadparm.c:4004) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab82 is 18 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x4849782: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927E1C: talloc_strdup (talloc.c:2470) ==6055== by 0x4B5974B: add_to_file_list (loadparm.c:1023) ==6055== by 0x4889BD4: lp_load_ex (loadparm.c:4011) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab70 is 0 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x4849794: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927E1C: talloc_strdup (talloc.c:2470) ==6055== by 0x4B5974B: add_to_file_list (loadparm.c:1023) ==6055== by 0x4889BD4: lp_load_ex (loadparm.c:4011) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab71 is 1 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 8 ==6055== at 0x484D3AE: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927DC2: __talloc_strlendup (talloc.c:2457) ==6055== by 0x4927E32: talloc_strdup (talloc.c:2470) ==6055== by 0x4B5974B: add_to_file_list (loadparm.c:1023) ==6055== by 0x4889BD4: lp_load_ex (loadparm.c:4011) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab70 is 0 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 2 ==6055== at 0x484D400: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927DC2: __talloc_strlendup (talloc.c:2457) ==6055== by 0x4927E32: talloc_strdup (talloc.c:2470) ==6055== by 0x4B5974B: add_to_file_list (loadparm.c:1023) ==6055== by 0x4889BD4: lp_load_ex (loadparm.c:4011) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab80 is 16 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== ==6055== Invalid read of size 1 ==6055== at 0x484D430: memmove (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4927DC2: __talloc_strlendup (talloc.c:2457) ==6055== by 0x4927E32: talloc_strdup (talloc.c:2470) ==6055== by 0x4B5974B: add_to_file_list (loadparm.c:1023) ==6055== by 0x4889BD4: lp_load_ex (loadparm.c:4011) ==6055== by 0x488A29E: lp_load_with_registry_shares (loadparm.c:4237) ==6055== by 0x10EC06: main (testparm.c:864) ==6055== Address 0x72dab82 is 18 bytes inside a block of size 20 free'd ==6055== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB28B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x4BB35D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EBAC: main (testparm.c:854) ==6055== Block was alloc'd at ==6055== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6055== by 0x4BB42EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6055== by 0x10EB2E: main (testparm.c:830) ==6055== BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Ralph Boehme (cherry picked from commit 4b15d8c2a5c8547b84e7926fed9890b5676b8bc3) --- source3/utils/testparm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c index 9555b436260..c751c06dcc9 100644 --- a/source3/utils/testparm.c +++ b/source3/utils/testparm.c @@ -843,13 +843,13 @@ static void do_per_share_checks(int s) } if (poptPeekArg(pc)) { - config_file = poptGetArg(pc); + config_file = talloc_strdup(frame, poptGetArg(pc)); } else { config_file = get_dyn_CONFIGFILE(); } - cname = poptGetArg(pc); - caddr = poptGetArg(pc); + cname = talloc_strdup(frame, poptGetArg(pc)); + caddr = talloc_strdup(frame, poptGetArg(pc)); poptFreeContext(pc); -- 2.38.0 From 26677b1c7e76ca4f505268e9d09c7848ce2a164d Mon Sep 17 00:00:00 2001 From: Noel Power Date: Fri, 14 Oct 2022 11:53:53 +0100 Subject: [PATCH 6/9] s4/lib/registry: Fix use after free with popt 1.19 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit popt1.19 fixes a leak that exposes a use as free, make sure we duplicate return of poptGetArg if poptFreeContext is called before we use it. ==6357== Command: ./bin/regpatch file ==6357== Can't load /home/npower/samba-back/INSTALL_DIR/etc/smb.conf - run testparm to debug it ==6357== Syscall param openat(filename) points to unaddressable byte(s) ==6357== at 0x4BFE535: open (in /usr/lib64/libc.so.6) ==6357== by 0x4861432: reg_diff_load (patchfile.c:345) ==6357== by 0x4861CD3: reg_diff_apply (patchfile.c:542) ==6357== by 0x10ADF9: main (regpatch.c:114) ==6357== Address 0x70f79d0 is 0 bytes inside a block of size 5 free'd ==6357== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF38B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x4AF45D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ADCF: main (regpatch.c:111) ==6357== Block was alloc'd at ==6357== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF52EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ACBD: main (regpatch.c:79) ==6357== ==6357== Invalid read of size 1 ==6357== at 0x4849782: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4B5D50F: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4B7E719: __vasprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4AD32F0: __dbgtext_va (debug.c:1904) ==6357== by 0x4AD33F2: dbgtext (debug.c:1925) ==6357== by 0x4861515: reg_diff_load (patchfile.c:353) ==6357== by 0x4861CD3: reg_diff_apply (patchfile.c:542) ==6357== by 0x10ADF9: main (regpatch.c:114) ==6357== Address 0x70f79d0 is 0 bytes inside a block of size 5 free'd ==6357== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF38B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x4AF45D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ADCF: main (regpatch.c:111) ==6357== Block was alloc'd at ==6357== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF52EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ACBD: main (regpatch.c:79) ==6357== ==6357== Invalid read of size 1 ==6357== at 0x4849794: strlen (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4B5D50F: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4B7E719: __vasprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4AD32F0: __dbgtext_va (debug.c:1904) ==6357== by 0x4AD33F2: dbgtext (debug.c:1925) ==6357== by 0x4861515: reg_diff_load (patchfile.c:353) ==6357== by 0x4861CD3: reg_diff_apply (patchfile.c:542) ==6357== by 0x10ADF9: main (regpatch.c:114) ==6357== Address 0x70f79d1 is 1 bytes inside a block of size 5 free'd ==6357== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF38B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x4AF45D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ADCF: main (regpatch.c:111) ==6357== Block was alloc'd at ==6357== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF52EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ACBD: main (regpatch.c:79) ==6357== ==6357== Invalid read of size 1 ==6357== at 0x4B83DD0: _IO_default_xsputn (in /usr/lib64/libc.so.6) ==6357== by 0x4B5D39E: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4B7E719: __vasprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4AD32F0: __dbgtext_va (debug.c:1904) ==6357== by 0x4AD33F2: dbgtext (debug.c:1925) ==6357== by 0x4861515: reg_diff_load (patchfile.c:353) ==6357== by 0x4861CD3: reg_diff_apply (patchfile.c:542) ==6357== by 0x10ADF9: main (regpatch.c:114) ==6357== Address 0x70f79d0 is 0 bytes inside a block of size 5 free'd ==6357== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF38B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x4AF45D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ADCF: main (regpatch.c:111) ==6357== Block was alloc'd at ==6357== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF52EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ACBD: main (regpatch.c:79) ==6357== ==6357== Invalid read of size 1 ==6357== at 0x4B83DDF: _IO_default_xsputn (in /usr/lib64/libc.so.6) ==6357== by 0x4B5D39E: __vfprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4B7E719: __vasprintf_internal (in /usr/lib64/libc.so.6) ==6357== by 0x4AD32F0: __dbgtext_va (debug.c:1904) ==6357== by 0x4AD33F2: dbgtext (debug.c:1925) ==6357== by 0x4861515: reg_diff_load (patchfile.c:353) ==6357== by 0x4861CD3: reg_diff_apply (patchfile.c:542) ==6357== by 0x10ADF9: main (regpatch.c:114) ==6357== Address 0x70f79d2 is 2 bytes inside a block of size 5 free'd ==6357== at 0x484617B: free (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF38B8: poptResetContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x4AF45D4: poptFreeContext (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ADCF: main (regpatch.c:111) ==6357== Block was alloc'd at ==6357== at 0x48437B4: malloc (in /usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so) ==6357== by 0x4AF52EE: poptGetNextOpt (in /usr/lib64/libpopt.so.0.0.2) ==6357== by 0x10ACBD: main (regpatch.c:79) ==6357== Error reading registry patch file `file' BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Ralph Boehme Autobuild-User(master): Ralph Böhme Autobuild-Date(master): Fri Oct 14 13:38:55 UTC 2022 on sn-devel-184 (cherry picked from commit 7e0e3f47cd67e4cadc101691cd14837f45d9506a) --- source4/lib/registry/tools/regpatch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source4/lib/registry/tools/regpatch.c b/source4/lib/registry/tools/regpatch.c index 2be78d143ef..eafaff6cf99 100644 --- a/source4/lib/registry/tools/regpatch.c +++ b/source4/lib/registry/tools/regpatch.c @@ -101,7 +101,7 @@ int main(int argc, char **argv) return 1; } - patch = poptGetArg(pc); + patch = talloc_strdup(mem_ctx, poptGetArg(pc)); if (patch == NULL) { poptPrintUsage(pc, stderr, 0); TALLOC_FREE(mem_ctx); -- 2.38.0 From e4b3b60edc81076bb5318aecb7261917af8c1fb7 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Mon, 17 Oct 2022 10:17:34 +0100 Subject: [PATCH 7/9] s3/param: Check return of talloc_strdup followup to commit ff003fc87b8164610dfd6572347c05308c4b2fd7 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Jeremy Allison (cherry picked from commit 19eb88bc53e481327bbd437b0c145d5765c6dcec) --- source3/param/test_lp_load.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source3/param/test_lp_load.c b/source3/param/test_lp_load.c index 03be4118efd..9f3d5516805 100644 --- a/source3/param/test_lp_load.c +++ b/source3/param/test_lp_load.c @@ -83,6 +83,11 @@ int main(int argc, const char **argv) if (poptPeekArg(pc)) { config_file = talloc_strdup(frame, poptGetArg(pc)); + if (config_file == NULL) { + DBG_ERR("out of memory\n"); + TALLOC_FREE(frame); + exit(1); + } } else { config_file = get_dyn_CONFIGFILE(); } -- 2.38.0 From d98c0eb81f15126b67feb631a0063f73732ccaba Mon Sep 17 00:00:00 2001 From: Noel Power Date: Mon, 17 Oct 2022 10:25:00 +0100 Subject: [PATCH 8/9] s3/utils: Check return of talloc_strdup followup to e82699fcca3716d9ed0450263fd83f948de8ffbe BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Jeremy Allison (cherry picked from commit 972127daddc7a32d23fb84d97102557035b06f5b) --- source3/utils/pdbedit.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/source3/utils/pdbedit.c b/source3/utils/pdbedit.c index eb4f3072df8..ede467108bb 100644 --- a/source3/utils/pdbedit.c +++ b/source3/utils/pdbedit.c @@ -1149,8 +1149,16 @@ int main(int argc, const char **argv) poptGetArg(pc); /* Drop argv[0], the program name */ - if (user_name == NULL) - user_name = talloc_strdup(frame, poptGetArg(pc)); + if (user_name == NULL) { + if (poptPeekArg(pc)) { + user_name = talloc_strdup(frame, poptGetArg(pc)); + if (user_name == NULL) { + fprintf(stderr, "out of memory\n"); + TALLOC_FREE(frame); + exit(1); + } + } + } setparms = (backend ? BIT_BACKEND : 0) + (verbose ? BIT_VERBOSE : 0) + -- 2.38.0 From 9703e84a814a9fcd5aba665ffdfd5d033e8ce365 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Mon, 17 Oct 2022 10:27:31 +0100 Subject: [PATCH 9/9] s3/utils: check result of talloc_strdup follow to commit 4b15d8c2a5c8547b84e7926fed9890b5676b8bc3 BUG: https://bugzilla.samba.org/show_bug.cgi?id=15205 Signed-off-by: Noel Power Reviewed-by: Jeremy Allison Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Mon Oct 17 19:49:37 UTC 2022 on sn-devel-184 (cherry picked from commit 0326549a052c22e4929e3760fd5011c35e32fe33) --- source3/utils/testparm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source3/utils/testparm.c b/source3/utils/testparm.c index c751c06dcc9..e0455b9d7b6 100644 --- a/source3/utils/testparm.c +++ b/source3/utils/testparm.c @@ -844,6 +844,11 @@ static void do_per_share_checks(int s) if (poptPeekArg(pc)) { config_file = talloc_strdup(frame, poptGetArg(pc)); + if (config_file == NULL) { + DBG_ERR("out of memory\n"); + TALLOC_FREE(frame); + exit(1); + } } else { config_file = get_dyn_CONFIGFILE(); } -- 2.38.0