Bug 15305 - Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c
Summary: Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwri...
Status: RESOLVED DUPLICATE of bug 15306
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: libsmbclient (show other bugs)
Version: 4.18.0rc2
Hardware: All All
: P5 major (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-02-09 16:00 UTC by fouzhe
Modified: 2023-02-09 19:02 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description fouzhe 2023-02-09 16:00:30 UTC
I found a FPE bug and here is the STDERR of smbclient:
```
Unknown parameter encountered: "challenge"
Ignoring unknown parameter "challenge"
lpcfg_do_global_parameter: WARNING: The "lanman auth" option is deprecated
lpcfg_do_global_parameter: WARNING: The "client lanman auth" option is deprecated
lpcfg_do_global_parameter: WARNING: The "client NTLMv2 auth" option is deprecated
lpcfg_do_global_parameter: WARNING: The "raw NTLMv2 auth" option is deprecated
AddressSanitizer:DEADLYSIGNAL
=================================================================
==24749==ERROR: AddressSanitizer: FPE on unknown address 0x7f37f746e97f (pc 0x7f37f746e97f bp 0x7ffeb0889370 sp 0x7ffeb08892a0 T0)
    #0 0x7f37f746e97f in cli_pull_send ../../source3/libsmb/clireadwrite.c:379
    #1 0x7f37f746ee58 in cli_pull ../../source3/libsmb/clireadwrite.c:686
    #2 0x5593e36332ae in do_get ../../source3/client/client.c:1119
    #3 0x5593e3644076 in cmd_get ../../source3/client/client.c:1197
    #4 0x5593e364b36d in process_stdin ../../source3/client/client.c:6155
    #5 0x5593e364b36d in process ../../source3/client/client.c:6200
    #6 0x5593e364b36d in main ../../source3/client/client.c:6724
    #7 0x7f37f58fed09 in __libc_start_main ../csu/libc-start.c:308
    #8 0x5593e362f459 in _start (/usr/local/samba/bin/smbclient+0x1d459)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE ../../source3/libsmb/clireadwrite.c:379 in cli_pull_send
==24749==ABORTING
```

The cli_pull_send function in clireadwrite.c (https://gitlab.com/samba-team/samba/-/blob/master/source3/libsmb/clireadwrite.c) does not check `state->chunk_size` before dividing it in line 379:

```c
tmp64 = window_size/state->chunk_size;
```
Comment 1 Douglas Bagnall 2023-02-09 19:02:46 UTC

*** This bug has been marked as a duplicate of bug 15306 ***