sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

smbd: fix check_parent_access() talloc stackframe leaks

Browse Source 
check_parent_access() currently leaks a number of allocations onto the
talloc_tos() context in both success and error paths.

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Fri Mar 15 11:32:04 UTC 2019 on sn-devel-144
This commit is contained in:
David Disseldorp 2019-03-12 18:49:09 +01:00
parent edd4a23d76
commit 1375e08580
1 changed files with 18 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
source3/smbd/open.c
View File

@ -258,21 +258,24 @@ NTSTATUS check_parent_access(struct connection_struct *conn,
uint32_t name_hash; uint32_t name_hash;
bool delete_on_close_set; bool delete_on_close_set;
int ret; int ret;
TALLOC_CTX *frame = talloc_stackframe();
if (!parent_dirname(talloc_tos(), if (!parent_dirname(frame,
smb_fname->base_name, smb_fname->base_name,
&parent_dir, &parent_dir,
NULL)) { NULL)) {
return NT_STATUS_NO_MEMORY; status = NT_STATUS_NO_MEMORY;
goto out;
} }
parent_smb_fname = synthetic_smb_fname(talloc_tos(), parent_smb_fname = synthetic_smb_fname(frame,
parent_dir, parent_dir,
NULL, NULL,
NULL, NULL,
smb_fname->flags); smb_fname->flags);
if (parent_smb_fname == NULL) { if (parent_smb_fname == NULL) {
return NT_STATUS_NO_MEMORY; status = NT_STATUS_NO_MEMORY;
goto out;
} }
if (get_current_uid(conn) == (uid_t)0) { if (get_current_uid(conn) == (uid_t)0) {
@ -281,13 +284,14 @@ NTSTATUS check_parent_access(struct connection_struct *conn,
"on %s. Granting 0x%x\n", "on %s. Granting 0x%x\n",
smb_fname_str_dbg(smb_fname), smb_fname_str_dbg(smb_fname),
(unsigned int)access_mask )); (unsigned int)access_mask ));
return NT_STATUS_OK; status = NT_STATUS_OK;
goto out;
} }
status = SMB_VFS_GET_NT_ACL(conn, status = SMB_VFS_GET_NT_ACL(conn,
parent_smb_fname, parent_smb_fname,
SECINFO_DACL, SECINFO_DACL,
talloc_tos(), frame,
&parent_sd); &parent_sd);
if (!NT_STATUS_IS_OK(status)) { if (!NT_STATUS_IS_OK(status)) {
@ -295,7 +299,7 @@ NTSTATUS check_parent_access(struct connection_struct *conn,
"%s with error %s\n", "%s with error %s\n",
parent_dir, parent_dir,
nt_errstr(status))); nt_errstr(status)));
return status; goto out;
} }
/* /*
@ -322,14 +326,16 @@ NTSTATUS check_parent_access(struct connection_struct *conn,
access_mask, access_mask,
access_granted, access_granted,
nt_errstr(status) )); nt_errstr(status) ));
return status; goto out;
} }
if (!(access_mask & (SEC_DIR_ADD_FILE | SEC_DIR_ADD_SUBDIR))) { if (!(access_mask & (SEC_DIR_ADD_FILE | SEC_DIR_ADD_SUBDIR))) {
return NT_STATUS_OK; status = NT_STATUS_OK;
goto out;
} }
if (!lp_check_parent_directory_delete_on_close(SNUM(conn))) { if (!lp_check_parent_directory_delete_on_close(SNUM(conn))) {
return NT_STATUS_OK; status = NT_STATUS_OK;
goto out;
} }
/* Check if the directory has delete-on-close set */ /* Check if the directory has delete-on-close set */
@ -346,7 +352,7 @@ NTSTATUS check_parent_access(struct connection_struct *conn,
goto out; goto out;
} }
lck = get_existing_share_mode_lock(talloc_tos(), id); lck = get_existing_share_mode_lock(frame, id);
if (lck == NULL) { if (lck == NULL) {
status = NT_STATUS_OK; status = NT_STATUS_OK;
goto out; goto out;
@ -361,8 +367,7 @@ NTSTATUS check_parent_access(struct connection_struct *conn,
status = NT_STATUS_OK; status = NT_STATUS_OK;
out: out:
TALLOC_FREE(lck); TALLOC_FREE(frame);
TALLOC_FREE(parent_smb_fname);
return status; return status;
} }