Bug 2139 - SIGBUS at smbd while executing rpc-setdriver-command
Summary: SIGBUS at smbd while executing rpc-setdriver-command
Status: CLOSED FIXED
Alias: None
Product: Samba 3.0
Classification: Unclassified
Component: Printing (show other bugs)
Version: 3.0.9
Hardware: Sparc Solaris
: P3 critical
Target Milestone: none
Assignee: Gerald (Jerry) Carter (dead mail address)
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-12-09 06:01 UTC by Olaf Imig
Modified: 2005-08-24 10:17 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Olaf Imig 2004-12-09 06:01:16 UTC
While executing a setdriver-command with the rpcclient smbd got signal SIGBUS
(10). This BUG is reproducible. 
REASON:
The reason is the following cast: 
source/printing/printing.c at line 1211 in function print_queue_receive
  ctx = (struct print_queue_update_context*)buf;
ctx and his members are misaligned and the next call 
  get_printer_fns_from_type(ctx->printing_type),
		ctx->lpqcommand );
results in the signal SIGBUS. The construct works under Linux but never under
Sparc-Solaris because structures must be 4 byte aligned.
SOLUTION:
--- samba-3.0.9/source/printing/printing.c.ori  2004-12-09 11:21:46.014043000 +0100
+++ samba-3.0.9/source/printing/printing.c      2004-12-09 12:10:03.946840000 +0100
@@ -1207,11 +1207,14 @@
                DEBUG(1, ("Got invalid print queue update message\n"));
                return;
        }
-
-       ctx = (struct print_queue_update_context*)buf;
+        ctx = (struct print_queue_update_context *)malloc(sizeof(struct
print_queue_update_context));
+       if(!ctx)
+               return;
+       memcpy(ctx,buf,sizeof(struct print_queue_update_context));
        print_queue_update_internal(ctx->sharename,
                get_printer_fns_from_type(ctx->printing_type),
                ctx->lpqcommand );
+       free(ctx);
 }

 static pid_t background_lpq_updater_pid = -1;

m.f.g.
Comment 1 Gerald (Jerry) Carter (dead mail address) 2004-12-09 06:47:29 UTC
Thanks.  Your patch is correct but this code has already 
been rewritten.  See the patch posted at 

http://samba.org/~jerry/patches/post-3.0.9/printing-3-0-9.patch
Comment 2 Gerald (Jerry) Carter (dead mail address) 2005-08-24 10:17:44 UTC
sorry for the same, cleaning up the database to prevent unecessary reopens of bugs.