Attachment 19141 Details for Bug 16093 – Patch for v4-23-test

Patch for v4-23-test

bfixes-tmp423.txt (text/plain), 2.04 KB, created by Stefan Metzmacher on 2026-07-28 16:42:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Metzmacher

Created: 2026-07-28 16:42:01 UTC

Size: 2.04 KB

patch

obsolete

>From a9abb0bfbf1cc70b7082f4fd40152b11c91f7634 Mon Sep 17 00:00:00 2001
>From: Stefan Metzmacher <metze@samba.org>
>Date: Thu, 14 May 2026 13:34:13 +0200
>Subject: [PATCH] s3:rpc_server/dfs: fix temporary read of unrelated or
> non-existing memory
>
>This was reported by Arjun Basnet with Securin Labs.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=16093
>
>Signed-off-by: Stefan Metzmacher <metze@samba.org>
>Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
>(cherry picked from commit 3b7730b3702875d92b5dc0e90410ae26c7355138)
>---
> source3/rpc_server/dfs/srv_dfs_nt.c | 13 ++++---------
> 1 file changed, 4 insertions(+), 9 deletions(-)
>
>diff --git a/source3/rpc_server/dfs/srv_dfs_nt.c b/source3/rpc_server/dfs/srv_dfs_nt.c
>index d8aeb76a1fb8..3c7ad5d5053c 100644
>--- a/source3/rpc_server/dfs/srv_dfs_nt.c
>+++ b/source3/rpc_server/dfs/srv_dfs_nt.c
>@@ -57,7 +57,6 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r)
> 	struct auth_session_info *session_info =
> 		dcesrv_call_session_info(dce_call);
> 	struct junction_map *jn = NULL;
>-	struct referral *old_referral_list = NULL;
> 	bool self_ref = False;
> 	size_t consumedcnt = 0;
> 	char *altpath = NULL;
>@@ -104,23 +103,19 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r)
> 	}
> 
> 	jn->referral_count += 1;
>-	old_referral_list = jn->referral_list;
>-
> 	if (jn->referral_count < 1) {
> 		return WERR_NOT_ENOUGH_MEMORY;
> 	}
> 
>-	jn->referral_list = talloc_array(ctx, struct referral, jn->referral_count);
>+	jn->referral_list = talloc_realloc(ctx,
>+					   jn->referral_list,
>+					   struct referral,
>+					   jn->referral_count);
> 	if(jn->referral_list == NULL) {
> 		DEBUG(0,("init_reply_dfs_add: talloc failed for referral list!\n"));
> 		return WERR_NERR_DFSINTERNALERROR;
> 	}
> 
>-	if(old_referral_list && jn->referral_list) {
>-		memcpy(jn->referral_list, old_referral_list,
>-				sizeof(struct referral)*jn->referral_count-1);
>-	}
>-
> 	jn->referral_list[jn->referral_count-1].proximity = 0;
> 	jn->referral_list[jn->referral_count-1].ttl = REFERRAL_TTL;
> 	jn->referral_list[jn->referral_count-1].alternate_path = altpath;
>-- 
>2.43.0
>

Flags:

metze: review? (gary)
gary: review+

Actions: View

Attachments on bug 16093: 19140 | 19141