sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-02 09:47:23 +03:00
Code

s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid.

Browse Source 
Bug #11186: Crash seen in libsmbclient due to free of server structure during SMBC_getxattr() call

Bug: https://bugzilla.samba.org/show_bug.cgi?id=11186

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Tue Apr 14 02:58:43 CEST 2015 on sn-devel-104
This commit is contained in:
Jeremy Allison 2015-03-31 14:40:23 -07:00 committed by David Disseldorp
parent 2a6e170096
commit 2d4db4a65e
1 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
source3/libsmb/libsmb_xattr.c
View File

@ -2073,6 +2073,25 @@ SMBC_getxattr_ctx(SMBCCTX *context,
if (! srv->no_nt_session) {
ipc_srv = SMBC_attr_server(frame, context, server, port, share,
&workgroup, &user, &password);
/*
* SMBC_attr_server() can cause the original
* server to be removed from the cache.
* If so we must error out here as the srv
* pointer has been freed.
*/
if (smbc_getFunctionGetCachedServer(context)(context,
server,
share,
workgroup,
user) != srv) {
#if defined(ECONNRESET)
errno = ECONNRESET;
#else
errno = ETIMEDOUT;
#endif
TALLOC_FREE(frame);
return -1;
}
if (! ipc_srv) {
srv->no_nt_session = True;
}
@ -2208,9 +2227,31 @@ SMBC_removexattr_ctx(SMBCCTX *context,
}
if (! srv->no_nt_session) {
int saved_errno;
ipc_srv = SMBC_attr_server(frame, context, server, port, share,
&workgroup, &user, &password);
saved_errno = errno;
/*
* SMBC_attr_server() can cause the original
* server to be removed from the cache.
* If so we must error out here as the srv
* pointer has been freed.
*/
if (smbc_getFunctionGetCachedServer(context)(context,
server,
share,
workgroup,
user) != srv) {
#if defined(ECONNRESET)
errno = ECONNRESET;
#else
errno = ETIMEDOUT;
#endif
TALLOC_FREE(frame);
return -1;
}
if (! ipc_srv) {
errno = saved_errno;
srv->no_nt_session = True;
}
} else {