sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-24 02:04:21 +03:00
Code

s4-smb_server: Fix a use after free.

Browse Source 
If we haven't allocated the smbsrv_session then we should not free it.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
Andreas Schneider 2013-11-08 16:14:35 +01:00 committed by Jeremy Allison
parent 29f12e7d59
commit 12a2230581
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
source4/smb_server/smb/sesssetup.c
View File

@ -415,6 +415,7 @@ static void sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup *se
{
NTSTATUS status;
struct smbsrv_session *smb_sess = NULL;
bool is_smb_sess_new = false;
struct sesssetup_spnego_state *s = NULL;
uint16_t vuid;
struct tevent_req *subreq;
@ -465,6 +466,7 @@ static void sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup *se
status = NT_STATUS_INSUFFICIENT_RESOURCES;
goto failed;
}
is_smb_sess_new = true;
} else {
smb_sess = smbsrv_session_find_sesssetup(req->smb_conn, vuid);
}
@ -510,7 +512,9 @@ static void sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup *se
nomem:
status = NT_STATUS_NO_MEMORY;
failed:
if (is_smb_sess_new) {
talloc_free(smb_sess);
}
status = nt_status_squash(status);
smbsrv_sesssetup_backend_send(req, sess, status);
}