and here is the fix we verified: rec = dbwrap_fetch_locked(leases_db, talloc_tos(), db_key); TALLOC_FREE(db_key.dptr); if (rec == NULL) { - return NT_STATUS_NOT_FOUND; + return NT_STATUS_INTERNAL_ERROR; } db_value = dbwrap_record_get_value(rec); if (db_value.dsize == 0) { - status = NT_STATUS_INTERNAL_ERROR; - goto out; + TALLOC_FREE(rec); + return NT_STATUS_NOT_FOUND; } value = talloc(talloc_tos(), struct leases_db_value);
Can you post that patch to samba-technical@lists.samba.org with git information? See https://wiki.samba.org/index.php/Contribute for some quick info
Created attachment 12790 [details] patch
Sorry my bad. I was looking at 4.2.x code and didn't check master branch. The issue seems already fixed. The crash in 4.2.x is here: https://github.com/samba-team/samba/blob/v4-2-stable/source3/locking/leases_db.c#L311 if db_value.dsize is 0, it jumps to “out”, and tries to TALLOC_FREE(value), but value is uninitialized.