Bug 16093 - temporary read of unrelated or non-existing memory in s3 dfs server
Summary: temporary read of unrelated or non-existing memory in s3 dfs server
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: DCE-RPCs and pipes (show other bugs)
Version: 4.24.3
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba release manager
QA Contact: Samba QA Contact
URL: https://gitlab.com/samba-team/samba/-...
Keywords:
Depends on:
Blocks:
 
Reported: 2026-05-28 15:24 UTC by Stefan Metzmacher
Modified: 2026-08-13 14:31 UTC (History)
1 user (show)

See Also:

Attachments
Patch for v4-24-test (2.02 KB, text/plain)
2026-07-28 16:41 UTC, Stefan Metzmacher 		metze: review? (gary)
gary: review+
Details
Patch for v4-23-test (2.04 KB, text/plain)
2026-07-28 16:42 UTC, Stefan Metzmacher 		metze: review? (gary)
gary: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Metzmacher 2026-05-28 15:24:48 UTC 
_dfs_Add() uses a strange way to realloc the jn->referral_list array.

There's a temporary read of unrelated or non-existing memory,
but we directly overwrite the wrong initialized values again.

This was reported by Arjun Basnet with Securin Labs.
Comment 1 Samba QA Contact 2026-07-02 09:34:12 UTC 
This bug was referenced in samba master:

3b7730b3702875d92b5dc0e90410ae26c7355138
Comment 2 Stefan Metzmacher 2026-07-28 16:41:25 UTC 
Created attachment 19140 [details]
Patch for v4-24-test
Comment 3 Stefan Metzmacher 2026-07-28 16:42:01 UTC 
Created attachment 19141 [details]
Patch for v4-23-test
Comment 4 Samba QA Contact 2026-07-29 12:13:03 UTC 
This bug was referenced in samba v4-24-test:

0fa4d138772f11343b284ce4741f56fc7c2b013e
Comment 5 Samba QA Contact 2026-07-30 23:12:11 UTC 
This bug was referenced in samba v4-23-test:

b4273914a022965f79c40856db7752b080e6cd84
Comment 6 Samba QA Contact 2026-08-03 19:36:37 UTC 
This bug was referenced in samba v4-23-stable (Release samba-4.23.11):

b4273914a022965f79c40856db7752b080e6cd84
Comment 7 Samba QA Contact 2026-08-13 14:31:04 UTC 
This bug was referenced in samba v4-24-stable (Release samba-4.24.6):

0fa4d138772f11343b284ce4741f56fc7c2b013e