Bug 15907 - Stack buffer overflow in samba3.smb2.dirlease.fileserver
Summary: Stack buffer overflow in samba3.smb2.dirlease.fileserver
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: File services (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Jule Anger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-09 07:20 UTC by Andreas Schneider
Modified: 2025-09-12 08:29 UTC (History)
1 user (show)

See Also:


Attachments
patch for 4.23 (1.15 KB, patch)
2025-09-09 09:36 UTC, Andreas Schneider
pfilipensky: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Schneider 2025-09-09 07:20:22 UTC
[1(0)/1 at 7s] samba3.smb2.dirlease(fileserver)                                                                                                                                     
=================================================================                                                                                                                   
==1048988==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7b82c7b4d828 at pc 0x0000011ecdc1 bp 0x7ffcadf847d0 sp 0x7ffcadf847c8                                        
READ of size 2 at 0x7b82c7b4d828 thread T0                                                                                                                                          
    #0 0x0000011ecdc0 in test_dirlease_oplocks ../../source4/torture/smb2/lease.c:1521                                                                                              
    #1 0x00000138d3aa in wrap_simple_1smb2_test ../../source4/torture/smb2/smb2.c:52                                                                                                
    #2 0x7f82d0d6df00 in internal_torture_run_test ../../lib/torture/torture.c:629                                                                                                  
    #3 0x7f82d0d6ea32 in torture_run_tcase_restricted ../../lib/torture/torture.c:760                                                                                               
    #4 0x7f82d0d6f260 in torture_run_suite_restricted ../../lib/torture/torture.c:473                                                                                               
    #5 0x00000154cd2d in run_matching ../../source4/torture/smbtorture.c:96                                                                                                         
    #6 0x00000154cdb4 in run_matching ../../source4/torture/smbtorture.c:106                                                                                                        
    #7 0x00000154dc72 in torture_run_named_tests ../../source4/torture/smbtorture.c:173                                                                                             
    #8 0x000001551da2 in main ../../source4/torture/smbtorture.c:770                                                                                                                
    #9 0x7f82cc211574 in __libc_start_call_main (/lib64/libc.so.6+0x3574) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)                                                       
    #10 0x7f82cc211627 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x3627) (BuildId: 48c4b9b1efb1df15da8e787f489128bf31893317)
    #11 0x000000a6f6e4 in _start (/home/asn/workspace/prj/oss/samba/asn-iakerb/bin/default/source4/torture/smbtorture+0xa6f6e4) (BuildId: b327fe89f260af7dce193eb5f0109230efeb1f0e)

Address 0x7b82c7b4d828 is located in stack of thread T0 at offset 40 in frame
    #0 0x0000011ecaec in test_dirlease_oplocks ../../source4/torture/smb2/lease.c:1497

  This frame has 2 object(s):
    [32, 40) 'levels' (line 1501) <== Memory access at offset 40 overflows this variable
    [64, 536) 'c' (line 1499)
Comment 1 Samba QA Contact 2025-09-09 09:28:03 UTC
This bug was referenced in samba master:

c5c238a879182a2dfe528ae49f97da75e242afe7
Comment 2 Andreas Schneider 2025-09-09 09:36:32 UTC
Created attachment 18711 [details]
patch for 4.23
Comment 3 Pavel Filipenský 2025-09-09 10:00:52 UTC
4.23 patch LGTM
Jule please add it to 4.23
Comment 4 Jule Anger 2025-09-09 15:56:42 UTC
Pushed to autobuild-v4-23-test.
Comment 5 Samba QA Contact 2025-09-11 10:18:11 UTC
This bug was referenced in samba v4-23-test:

8a85326c716bec807c6ab20523d8d5d352a36395
Comment 6 Jule Anger 2025-09-11 10:26:31 UTC
Closing out bug report.

Thanks!
Comment 7 Samba QA Contact 2025-09-12 08:29:29 UTC
This bug was referenced in samba v4-23-stable (Release samba-4.23.0):

8a85326c716bec807c6ab20523d8d5d352a36395