Bug 8016 - gpfs_get_xattr() returns buffer size instead of string length
gpfs_get_xattr() returns buffer size instead of string length
Status: RESOLVED FIXED
Product: Samba 3.5
Classification: Unclassified
Component: VFS Modules
3.5.8
All All
: P5 normal
: ---
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-03-16 11:44 UTC by Rolf Anders
Modified: 2011-03-23 19:54 UTC (History)
1 user (show)

See Also:


Attachments
0001-s3-Attempt-to-fix-bug-8016-gpfs_get_xattr-broken.patch (1.25 KB, patch)
2011-03-18 16:50 UTC, Volker Lendecke
metze: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Rolf Anders 2011-03-16 11:44:10 UTC
Created attachment 6305 [details]
0001-s3-Attempt-to-fix-bug-8016-gpfs_get_xattr-broken.patch

gpfs_get_xattr() prints DOS attributes as a string into a buffer.
It then returns the buffer size passed by the caller instead of the
string length, which eventually leads to ndr_pull_struct_blob() reading
past the end of the string.

This bug is already fixed in branch "v3-6-stable". However, it would be
nice if it were fixed in the next 3.5 release.
Comment 1 Volker Lendecke 2011-03-18 16:50:00 UTC
On Wed, Mar 16, 2011 at 12:44:10PM +0100, samba-bugs@samba.org wrote:
> gpfs_get_xattr() prints DOS attributes as a string into a buffer.
> It then returns the buffer size passed by the caller instead of the
> string length, which eventually leads to ndr_pull_struct_blob() reading
> past the end of the string.

Can you try the attached patch? I don't have the environment
handy right now, so this isn't even compiled. Please report
success or failure.

Volker
Comment 2 Rolf Anders 2011-03-18 19:17:55 UTC
It works (tested on AIX 5.3 with GPFS 3.4.0.4). Thanks!
Comment 3 Stefan Metzmacher 2011-03-19 08:41:02 UTC
Comment on attachment 6305 [details]
0001-s3-Attempt-to-fix-bug-8016-gpfs_get_xattr-broken.patch

Looks good
Comment 4 Stefan Metzmacher 2011-03-19 08:41:43 UTC
Karolin, please pick for the next 3.5 release
Comment 5 Karolin Seeger 2011-03-23 19:54:42 UTC
Pushed to v3-5-test.
Closing out bug report.

Thanks!