sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-28 01:58:17 +03:00
Code

s4/smbstreams: Fix memory use after free.

Browse Source 
The bug is that sometimes 'streams' is parent for 'new_name'.
With this said, 'new_name' must be dupped before 'streams'
pointer is freed.

Signed-off-by: Andrew Tridgell <tridge@samba.org>
This commit is contained in:
Kamen Mazdrashki 2009-12-06 01:59:42 +02:00 committed by Andrew Tridgell
parent bf7cc3262e
commit f1d9382b18
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
source4/ntvfs/posix/pvfs_streams.c
View File

@ -304,11 +304,15 @@ NTSTATUS pvfs_stream_rename(struct pvfs_state *pvfs, struct pvfs_filename *name,
}
status = pvfs_streams_save(pvfs, name, fd, streams);
talloc_free(streams);
/* update the in-memory copy of the name of the open file */
talloc_free(name->stream_name);
name->stream_name = talloc_strdup(name, new_name);
if (NT_STATUS_IS_OK(status)) {
/* update the in-memory copy of the name of the open file */
talloc_free(name->stream_name);
name->stream_name = talloc_strdup(name, new_name);
talloc_free(streams);
}
return status;
}