Server: Linux kernel 2.6.15
Client: Windows XP with SP2 and latest update

The "net view" command returns "System error 64 has occured." at the client side. It general a "PANIC: internal error" at the server side.
After traced the source code, it seems to be the function "libsmb/ntlmssp.c:ntlmssp_weaken_keys(NTLMSSP_STATE)" casusing the problem. If the "ntlmssp_state->session_key" is (NULL,0) and "ntlmssp_state->neg_flags" is set with NTLMSSP_NEGOTIATE_LM_KEY, session_key.length will be set to "8" without checking "session_key.data" is NULL. A session key with (NULL,8) will cause invalid pointer access in the later code. Our modification is following. It may not be appropriate in general and work for our environment only. Thank you very much.


void ntlmssp_weaken_keys(NTLMSSP_STATE *ntlmssp_state)
{
        /* Key weakening not performed on the master key for NTLM2
           and does not occour for NTLM1.  Therefore we only need
           to do this for the LM_KEY.
        */

        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_LM_KEY) {
                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_128) {
                        ;
                } else if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_56) {
                        ntlmssp_state->session_key.data[7] = 0xa0;
                        ntlmssp_state->session_key.length = 8;  /* new */
                } else { /* forty bits */
                        ntlmssp_state->session_key.data[5] = 0xe5;
                        ntlmssp_state->session_key.data[6] = 0x38;
                        ntlmssp_state->session_key.data[7] = 0xb0;
                        ntlmssp_state->session_key.length = 8; /* new */
                }
                
                /* ntlmssp_state->session_key.length = 8; */ /* original */

        }
}