The branch, master has been updated
via 1053a24 Part of fix for bug 8276 - FD_SET out of bounds access
crash.
from 4804013 script/librelease.sh: keep dots in the release tag
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 1053a24a87f341fcd5578db56bc8b3962e63bb98
Author: Jeremy Allison <[email protected]>
Date: Thu Jun 30 11:01:40 2011 -0700
Part of fix for bug 8276 - FD_SET out of bounds access crash.
Ensure we never add fd's set to -1 to the pollfd set.
Autobuild-User: Jeremy Allison <[email protected]>
Autobuild-Date: Thu Jun 30 21:15:25 CEST 2011 on sn-devel-104
-----------------------------------------------------------------------
Summary of changes:
source3/nmbd/nmbd_packets.c | 27 ++++++++++++++++++---------
1 files changed, 18 insertions(+), 9 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/nmbd/nmbd_packets.c b/source3/nmbd/nmbd_packets.c
index a89f49c..0324c9d 100644
--- a/source3/nmbd/nmbd_packets.c
+++ b/source3/nmbd/nmbd_packets.c
@@ -1698,7 +1698,12 @@ static bool create_listen_pollfds(struct pollfd **pfds,
for (subrec = FIRST_SUBNET;
subrec != NULL;
subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) {
- count += 2; /* nmb_sock and dgram_sock */
+ if (subrec->nmb_sock != -1) {
+ count += 1;
+ }
+ if (subrec->dgram_sock != -1) {
+ count += 1;
+ }
if (subrec->nmb_bcast != -1) {
count += 1;
}
@@ -1736,10 +1741,12 @@ static bool create_listen_pollfds(struct pollfd **pfds,
for (subrec = FIRST_SUBNET; subrec; subrec =
NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) {
- fds[num].fd = subrec->nmb_sock;
- attrs[num].type = NMB_PACKET;
- attrs[num].broadcast = false;
- num += 1;
+ if (subrec->nmb_sock != -1) {
+ fds[num].fd = subrec->nmb_sock;
+ attrs[num].type = NMB_PACKET;
+ attrs[num].broadcast = false;
+ num += 1;
+ }
if (subrec->nmb_bcast != -1) {
fds[num].fd = subrec->nmb_bcast;
@@ -1748,10 +1755,12 @@ static bool create_listen_pollfds(struct pollfd **pfds,
num += 1;
}
- fds[num].fd = subrec->dgram_sock;
- attrs[num].type = DGRAM_PACKET;
- attrs[num].broadcast = false;
- num += 1;
+ if (subrec->dgram_sock != -1) {
+ fds[num].fd = subrec->dgram_sock;
+ attrs[num].type = DGRAM_PACKET;
+ attrs[num].broadcast = false;
+ num += 1;
+ }
if (subrec->dgram_bcast != -1) {
fds[num].fd = subrec->dgram_bcast;
--
Samba Shared Repository
