|
 |
cf0886 |
From d31b7e056d790115bb3a3a838a8435dad3be8118 Mon Sep 17 00:00:00 2001
|
|
|
cf0886 |
From: Jeremy Allison <jra@samba.org>
|
|
|
cf0886 |
Date: Sat, 7 Jun 2014 21:51:44 -0700
|
|
|
cf0886 |
Subject: [PATCH] s3: smbd - fix processing of packets with invalid DOS charset
|
|
|
cf0886 |
conversions.
|
|
|
cf0886 |
|
|
|
cf0886 |
Bug 10654 - Segmentation fault in smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler
|
|
|
cf0886 |
|
|
|
cf0886 |
https://bugzilla.samba.org/show_bug.cgi?id=10654
|
|
|
cf0886 |
|
|
|
cf0886 |
Signed-off-by: Jeremy Allison <jra@samba.org>
|
|
|
cf0886 |
---
|
|
|
cf0886 |
source3/lib/charcnv.c | 26 +++++++++++++++++---------
|
|
|
cf0886 |
source3/libsmb/clirap.c | 4 ++--
|
|
|
cf0886 |
source3/smbd/lanman.c | 4 ++--
|
|
|
cf0886 |
3 files changed, 21 insertions(+), 13 deletions(-)
|
|
|
cf0886 |
|
|
|
cf0886 |
diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
|
|
|
cf0886 |
index 71d2c3a..2189812 100644
|
|
|
cf0886 |
--- a/source3/lib/charcnv.c
|
|
|
cf0886 |
+++ b/source3/lib/charcnv.c
|
|
|
cf0886 |
@@ -46,9 +46,9 @@ void gfree_charcnv(void)
|
|
|
cf0886 |
**/
|
|
|
cf0886 |
size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags)
|
|
|
cf0886 |
{
|
|
|
cf0886 |
- size_t src_len = strlen(src);
|
|
|
cf0886 |
+ size_t src_len = 0;
|
|
|
cf0886 |
char *tmpbuf = NULL;
|
|
|
cf0886 |
- size_t size;
|
|
|
cf0886 |
+ size_t size = 0;
|
|
|
cf0886 |
bool ret;
|
|
|
cf0886 |
|
|
|
cf0886 |
/* No longer allow a length of -1. */
|
|
|
cf0886 |
@@ -62,24 +62,32 @@ size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags)
|
|
|
cf0886 |
smb_panic("malloc fail");
|
|
|
cf0886 |
}
|
|
|
cf0886 |
if (!strupper_m(tmpbuf)) {
|
|
|
cf0886 |
+ if ((flags & (STR_TERMINATE|STR_TERMINATE_ASCII)) &&
|
|
|
cf0886 |
+ dest &&
|
|
|
cf0886 |
+ dest_len > 0) {
|
|
|
cf0886 |
+ *(char *)dest = 0;
|
|
|
cf0886 |
+ }
|
|
|
cf0886 |
SAFE_FREE(tmpbuf);
|
|
|
cf0886 |
- return (size_t)-1;
|
|
|
cf0886 |
+ return 0;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
src = tmpbuf;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
|
|
|
cf0886 |
+ src_len = strlen(src);
|
|
|
cf0886 |
if (flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) {
|
|
|
cf0886 |
src_len++;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
|
|
|
cf0886 |
ret = convert_string(CH_UNIX, CH_DOS, src, src_len, dest, dest_len, &size);
|
|
|
cf0886 |
- if (ret == false &&
|
|
|
cf0886 |
- (flags & (STR_TERMINATE | STR_TERMINATE_ASCII))
|
|
|
cf0886 |
- && dest_len > 0) {
|
|
|
cf0886 |
- ((char *)dest)[0] = '\0';
|
|
|
cf0886 |
- }
|
|
|
cf0886 |
SAFE_FREE(tmpbuf);
|
|
|
cf0886 |
- return ret ? size : (size_t)-1;
|
|
|
cf0886 |
+ if (ret == false) {
|
|
|
cf0886 |
+ if ((flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) &&
|
|
|
cf0886 |
+ dest_len > 0) {
|
|
|
cf0886 |
+ ((char *)dest)[0] = '\0';
|
|
|
cf0886 |
+ }
|
|
|
cf0886 |
+ return 0;
|
|
|
cf0886 |
+ }
|
|
|
cf0886 |
+ return size;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
|
|
|
cf0886 |
/********************************************************************
|
|
|
cf0886 |
diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c
|
|
|
cf0886 |
index 036919f..64e3767 100644
|
|
|
cf0886 |
--- a/source3/libsmb/clirap.c
|
|
|
cf0886 |
+++ b/source3/libsmb/clirap.c
|
|
|
cf0886 |
@@ -327,7 +327,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype,
|
|
|
cf0886 |
sizeof(param) - PTR_DIFF(p,param) - 1,
|
|
|
cf0886 |
STR_TERMINATE|STR_UPPER);
|
|
|
cf0886 |
|
|
|
cf0886 |
- if (len == (size_t)-1) {
|
|
|
cf0886 |
+ if (len == 0) {
|
|
|
cf0886 |
SAFE_FREE(last_entry);
|
|
|
cf0886 |
return false;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
@@ -339,7 +339,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype,
|
|
|
cf0886 |
sizeof(param) - PTR_DIFF(p,param) - 1,
|
|
|
cf0886 |
STR_TERMINATE);
|
|
|
cf0886 |
|
|
|
cf0886 |
- if (len == (size_t)-1) {
|
|
|
cf0886 |
+ if (len == 0) {
|
|
|
cf0886 |
SAFE_FREE(last_entry);
|
|
|
cf0886 |
return false;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
|
|
|
cf0886 |
index 63c2ad7..66ab8a2 100644
|
|
|
cf0886 |
--- a/source3/smbd/lanman.c
|
|
|
cf0886 |
+++ b/source3/smbd/lanman.c
|
|
|
cf0886 |
@@ -128,7 +128,7 @@ static int CopyExpanded(connection_struct *conn,
|
|
|
cf0886 |
return 0;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
|
|
|
cf0886 |
- if (l == -1) {
|
|
|
cf0886 |
+ if (l == 0) {
|
|
|
cf0886 |
return 0;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
(*dst) += l;
|
|
|
cf0886 |
@@ -143,7 +143,7 @@ static int CopyAndAdvance(char **dst, char *src, int *n)
|
|
|
cf0886 |
return 0;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
l = push_ascii(*dst,src,*n, STR_TERMINATE);
|
|
|
cf0886 |
- if (l == -1) {
|
|
|
cf0886 |
+ if (l == 0) {
|
|
|
cf0886 |
return 0;
|
|
|
cf0886 |
}
|
|
|
cf0886 |
(*dst) += l;
|
|
|
cf0886 |
--
|
|
|
cf0886 |
2.0.0.526.g5318336
|
|
|
cf0886 |
|