Created attachment 13161 [details]
patch with fix

I discovered a buffer overread detectable with address sanitizer that shows up when one tries to start a samba server and run smbclient -L against it.

The error is in these lines of cleanupdb_store_child (or at least... I'm 90% sure):

	TDB_DATA tdbkey = { .dptr = (uint8_t *)&key, .dsize = sizeof(key) };
	TDB_DATA tdbdata = { .dptr = (uint8_t *)&key, .dsize = sizeof(rec) };

So the idea here is probably to have a pointer to a buffer and then the size of the buffer in each TDB_DATA struct.

However as you can see both lines point to the key variable, yet the second one has sizeof(rec). Thus this doesn't match. The second line needs to point to &rec instead of &key.

Patch attached.

This bug will subsequently lead to an 8 byte buffer overread in tdb_write (part of tdb, not samba itself). I'll attach a stack trace as well.