The Samba-Bugzilla – Bug 10798
crash in source3/smbd/notify.c
Last modified: 2014-10-13 10:52:38 UTC
Created attachment 10260 [details]
don't sort -1 elements.
There is a qsort in notify.c's change_notify_reply() function.
We encountered numerous crashes in that function and after examining some of them, it looked like notify_buf->num_changes was -1 (so, no elements to sort).
It also looks like notify_marshall_changes(), called immediately after qsort, expects/handles when notify_buf->num_changes == -1.
We added protection to avoid calling qsort() when notify_buf->num_changes is less than 1 and the crashes we were experiencing stopped.
Attached is the diff.
Created attachment 10266 [details]
git-am fix for master.
Yeah, perfectly correct - we certainly call change_notify_reply() directly after setting notify_buf->num_changes to -1.
As we already have a -1 check inside notify_marshall_changes() I think the best fix is to move the qsort() inside of notify_marshall_changes(), as it's only ever done just before calling notify_marshall_changes().
Fix went into master but need back-porting for 4.1.x, 4.0.x - bug me to get this done next week !
OK, turns out this code (the timestamp qsort code) never got back-ported to 4.1 or 4.0.
This means the bug only exists in the 4.2.x code, and therefore is already fixed :-).