sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-23 09:57:40 +03:00
Code

smbXsrv_{open,session,tcon}: protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records

Browse Source 
I saw systems with locking.tdb records being part of:
  ctdb catdb smbXsrv_tcon_global.tdb

It's yet unknown how that happened, but we should not panic in srvsvc_*
calls because the info0 pointer was NULL.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14752

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jul  6 11:08:43 UTC 2021 on sn-devel-184
This commit is contained in:
Stefan Metzmacher 2021-07-05 17:17:30 +02:00
parent 7c3bb491ba
commit 00bab5b3c8
3 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
source3/smbd/smbXsrv_open.c
View File

@ -1645,6 +1645,15 @@ static NTSTATUS smbXsrv_open_global_parse_record(TALLOC_CTX *mem_ctx,
goto done;
}
if (global_blob.info.info0 == NULL) {
status = NT_STATUS_INTERNAL_DB_CORRUPTION;
DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
"key '%s' info0 NULL pointer - %s\n",
hex_encode_talloc(frame, key.dptr, key.dsize),
nt_errstr(status)));
goto done;
}
*global = talloc_move(mem_ctx, &global_blob.info.info0);
status = NT_STATUS_OK;
done:

7
source3/smbd/smbXsrv_session.c
View File

@ -2425,6 +2425,13 @@ static int smbXsrv_session_global_traverse_fn(struct db_record *rec, void *data)
goto done;
}
if (global_blob.info.info0 == NULL) {
DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
"key '%s' info0 NULL pointer\n",
hex_encode_talloc(frame, key.dptr, key.dsize)));
goto done;
}
global_blob.info.info0->db_rec = rec;
ret = state->fn(global_blob.info.info0, state->private_data);
done:

7
source3/smbd/smbXsrv_tcon.c
View File

@ -1209,6 +1209,13 @@ static int smbXsrv_tcon_global_traverse_fn(struct db_record *rec, void *data)
goto done;
}
if (global_blob.info.info0 == NULL) {
DEBUG(1,("Invalid record in smbXsrv_tcon_global.tdb:"
"key '%s' info0 NULL pointer\n",
hex_encode_talloc(frame, key.dptr, key.dsize)));
goto done;
}
global_blob.info.info0->db_rec = rec;
ret = state->fn(global_blob.info.info0, state->private_data);
done: