1
0
mirror of https://github.com/samba-team/samba.git synced 2025-06-18 19:17:08 +03:00

61 Commits

Author SHA1 Message Date
Jeremy Allison
23b825e9d2 Security fix for CVE-2008-1105: Boundary failure when parsing SMB responses
can result in a buffer overrun.
Jeremy.
2008-05-28 09:31:42 -07:00
Jeremy Allison
478a359ede Fix bug #5479, print spool shares require max_xmit to
be adhered to.
Jeremy.
2008-05-21 12:39:08 -07:00
Volker Lendecke
36740f4959 Fix bug 5399
Thanks to Jason Mader!

Volker
2008-04-19 17:04:09 +02:00
Jeremy Allison
d090d25cb7 Fix bug #5326 - OS/2 servers give strange "high word" replies for print jobs.
Jeremy.
2008-03-28 10:12:07 -07:00
Volker Lendecke
8dd6458049 More ssize_t->SMB_OFF_T 2008-03-28 15:32:02 +01:00
Volker Lendecke
19eb8c9316 On Solaris, size_t seems to be only 32 bit.
Fix bug 5341, thanks a lot to Karoly Vegh for testing it!

Volker
2008-03-21 13:41:42 +01:00
Volker Lendecke
24018d882d !NT_STATUS_IS_OK != NT_STATUS_IS_ERR
When reading from a pipe, Windows return STATUS_BUFFER_OVERFLOW which is *not*
an error.
2008-03-19 22:38:13 +01:00
Volker Lendecke
7d7a73944c Fix bug 5334
I did not test with a zero length file :-)
2008-03-18 13:49:46 +01:00
Volker Lendecke
f556c9e162 Correctly calculate the max read size 2008-03-08 22:28:01 +01:00
Volker Lendecke
d69b20111a Convert cli_read to use cli_pull 2008-03-06 13:28:23 +01:00
Volker Lendecke
76f9b360ee Add async cli_pull support
This is the big (and potentially controversial) one. It took a phone call to
explain to metze what is going on inside cli_pull_read_done, but I would really
like everybody to understand this function. It is a very good and reasonably
complex example of async programming. If we want more asynchronism in s3, this
is what we will have to deal with :-)

Make use of it in the smbclient "get" command.

Volker
2008-03-06 13:28:23 +01:00
Jeremy Allison
df3c464839 Fix bug found by Derrell - windows returns an read return
offset of zero if return size is zero. Should fix testread
libsmbclient code.
Jeremy.
2008-01-16 17:33:19 -08:00
Jeremy Allison
ef9b278b62 Windows insists on write sizes < max_xmit on signed connections.
Jeremy.
2008-01-14 13:46:06 -08:00
Jeremy Allison
d78045601a Add SMB encryption. Still fixing client decrypt but
negotiation works.
Jeremy.
2007-12-26 17:12:36 -08:00
Jeremy Allison
47640fb20e Ensure we don't use massive writes in pipe mode.
Jeremy.
2007-11-06 14:12:38 -08:00
Jeremy Allison
81ca5853b2 Change the client library to write directly out of
the incoming buffer in the non-signed case. Speeds
up writes by over 10% or so. Complete the server
recvfile implementation.
Jeremy.
2007-11-02 12:21:34 -07:00
Jeremy Allison
3d3d1b806a Our userlevel SMBwriteX call is non-standard in that it
sometimes uses a 12-word write and doesn't include a pad
byte (as Windows does). Fix this so that we are identical
to Windows clients. This will make recvfile processing
much easier to detect (as we can just read a standard
writeX header length to decide).
Jeremy.
2007-10-30 12:54:39 -07:00
Jeremy Allison
f35a266b3c RIP BOOL. Convert BOOL -> bool. I found a few interesting
bugs in various places whilst doing this (places that assumed
BOOL == int). I also need to fix the Samba4 pidl generation
(next checkin).
Jeremy.
2007-10-18 17:40:25 -07:00
Gerald (Jerry) Carter
5c6c8e1fe9 [GLUE] Rsync SAMBA_3_2_0 SVN r25598 in order to create the v3-2-test branch. 2007-10-10 15:34:30 -05:00
Andrew Tridgell
b0132e94fc r23784: use the GPLv3 boilerplate as recommended by the FSF and the license text 2007-10-10 12:28:22 -05:00
Jeremy Allison
407e6e695b r23779: Change from v2 or later to v3 or later.
Jeremy.
2007-10-10 12:28:20 -05:00
Jeremy Allison
2524d85465 r23148: Fix old old bug in cli_smbwrite() (not incrementing
data being sent). Patch from mnix@wanm.com.au.
Jeremy.
2007-10-10 12:22:48 -05:00
Jeremy Allison
a53268fb20 r22920: Add in the UNIX capability for 24-bit readX, as discussed
with the Apple guys and Linux kernel guys. Still looking
at how to do writeX as there's no recvfile().
Jeremy.
2007-10-10 12:22:08 -05:00
Jeremy Allison
2d80a96120 r22391: Looks bigger than it is. Make "inbuf" available
to all callers of smb_setlen (via set_message()
calls). This will allow the server to reflect back
the correct encryption context.
Jeremy.
2007-10-10 12:19:30 -05:00
Volker Lendecke
be9aaffdac r17333: Some C++ warnings 2007-10-10 11:38:26 -05:00
Jeremy Allison
dcef65acb5 r15162: Patch for bug #3668. Windows has a bug with LARGE_READX
where if you ask for exactly 64k bytes it returns 0.
Jeremy.
2007-10-10 11:16:27 -05:00
Jeremy Allison
1d710d06a2 r13915: Fixed a very interesting class of realloc() bugs found by Coverity.
realloc can return NULL in one of two cases - (1) the realloc failed,
(2) realloc succeeded but the new size requested was zero, in which
case this is identical to a free() call.

The error paths dealing with these two cases should be different,
but mostly weren't. Secondly the standard idiom for dealing with
realloc when you know the new size is non-zero is the following :

 tmp = realloc(p, size);
 if (!tmp) {
    SAFE_FREE(p);
    return error;
 } else {
    p = tmp;
 }

However, there were *many* *many* places in Samba where we were
using the old (broken) idiom of :

 p = realloc(p, size)
 if (!p) {
    return error;
 }

which will leak the memory pointed to by p on realloc fail.

This commit (hopefully) fixes all these cases by moving to
a standard idiom of :

 p = SMB_REALLOC(p, size)
 if (!p) {
    return error;
 }

Where if the realloc returns null due to the realloc failing
or size == 0 we *guarentee* that the storage pointed to by p
has been freed. This allows me to remove a lot of code that
was dealing with the standard (more verbose) method that required
a tmp pointer. This is almost always what you want. When a
realloc fails you never usually want the old memory, you
want to free it and get into your error processing asap.

For the 11 remaining cases where we really do need to keep the
old pointer I have invented the new macro SMB_REALLOC_KEEP_OLD_ON_ERROR,
which can be used as follows :

 tmp = SMB_REALLOC_KEEP_OLD_ON_ERROR(p, size);
 if (!tmp) {
    SAFE_FREE(p);
    return error;
 } else {
    p = tmp;
 }

SMB_REALLOC_KEEP_OLD_ON_ERROR guarentees never to free the
pointer p, even on size == 0 or realloc fail. All this is
done by a hidden extra argument to Realloc(), BOOL free_old_on_error
which is set appropriately by the SMB_REALLOC and SMB_REALLOC_KEEP_OLD_ON_ERROR
macros (and their array counterparts).

It remains to be seen what this will do to our Coverity bug count :-).

Jeremy.
2007-10-10 11:10:59 -05:00
Jeremy Allison
103cac7dd3 r13119: Fix for #1779 from William Jojo <jojowil@hvcc.edu>
Jeremy.
2007-10-10 11:06:14 -05:00
Gerald Carter
939c3cb5d7 r10656: BIG merge from trunk. Features not copied over
* \PIPE\unixinfo
* winbindd's {group,alias}membership new functions
* winbindd's lookupsids() functionality
* swat (trunk changes to be reverted as per discussion with Deryck)
2007-10-10 11:04:48 -05:00
Tim Potter
985dbb47d9 r8572: Remove crufty #define NO_SYSLOG as it's not used at all anymore. 2007-10-10 11:00:11 -05:00
Jeremy Allison
94779ccb39 r4212: Ensure we only look at the bottom bit of large_readx.
Set the 14 word version of write if size > 0xffff as
well as 64-bit offset.
Jeremy.
2007-10-10 10:53:37 -05:00
Jeremy Allison
9d4e57f06c r4188: Ensure we add in the upper length in the right place !
Jeremy.
2007-10-10 10:53:36 -05:00
Jeremy Allison
831cb21a87 r4186: Fix client & server to allow 127k READX calls.
Jeremy.
2007-10-10 10:53:36 -05:00
Jeremy Allison
620f2e608f r4088: Get medieval on our ass about malloc.... :-). Take control of all our allocation
functions so we can funnel through some well known functions. Should help greatly with
malloc checking.
HEAD patch to follow.
Jeremy.
2007-10-10 10:53:32 -05:00
Richard Sharpe
3eb33fbc64 r2959: If we want to support writes >= 65536 with cli_write, then it had better
return a size_t, not an ssize_t, and we had better left shift the upper
part of the write count, not right shift it.
2007-10-10 10:52:57 -05:00
Jeremy Allison
b1033fc77c r2373: Fix typo.
Jeremy.
2007-10-10 10:52:41 -05:00
Jeremy Allison
330025d1a6 r2371: Fix for talking to OS/2 clients (max_mux ignored) by Guenter Kukkukk <guenter.kukkukk@kukkukk.com>.
Bugid #1590.
Jeremy.
2007-10-10 10:52:41 -05:00
Jeremy Allison
68590b9e22 RPC fix from Ronan Waide <waider@waider.ie>. Tested with rpcecho.
Jeremy.
-
Gerald Carter
0fb724b321 *lots of small merges form HEAD
*sync up configure.in
*don't build torture tools in make all
*make sure to remove torture tools as part of make clean
-
Andrew Bartlett
3a7458f947 Merge from HEAD - make Samba compile with -Wwrite-strings without additional
warnings.  (Adds a lot of const).

Andrew Bartlett
-
Jeremy Allison
5431bae894 Merge Richard's write > 4Gb fix.
Jeremy.
-
Herb Lewis
17f685fdbf merge from 2.2 fix for smbclient large files -
Jeremy Allison
fff7f3cbe2 Test was reversed for ERRmoredata in cli_read.
Jeremy.
-
Gerald Carter
65e7b5273b sync'ing up for 3.0alpha20 release -
Andrew Tridgell
03ac082dcb updated the 3.0 branch from the head branch - ready for alpha18 -
Jeremy Allison
5b04b5f1df Correctly increment offset in cli_smbwrite.
Jeremy.
-
Jeremy Allison
24ef6258a1 Test against W2K that we're doing large read/writes correctly (we are).
At least with 14 word writes.
Jeremy.
-
Tim Potter
6a58c9bd06 Removed version number from file header.
Changed "SMB/Netbios" to "SMB/CIFS" in file header.
-
Jeremy Allison
01ff6ce496 Same fix as went into 2.2 (I'm waiting for jerry to finish some code).
Jeremy.
-
Andrew Tridgell
55d5828e60 use cli_is_error() instead of looking in smb_rcls, otherwise NT status
codes don't work correctly
-