The branch, v4-0-test has been updated
via d6ce4d6 VERSION: Bump version up to 4.0.20.
via 5a9c841 Merge tag 'samba-4.0.19' into v4-0-test
via 55c6def VERSION: Disable git snapshot for the 4.0.19 release.
via 764faed WHATSNEW: Add release notes for Samba 4.0.19.
via 76e8ea2 s3: smbd - fix processing of packets with invalid DOS
charset conversions.
via 161da2d s3: nmbd: Fix bug 10633 - nmbd denial of service
via 586586f VERSION: Bump version up to 4.0.19...
from 989e320 winbindd: Ensure we do not look at rid_array before
checking if it was returned
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v4-0-test
- Log -----------------------------------------------------------------
commit d6ce4d6376bf9d0dc50fb385289d5f6ec25e8c9f
Author: Karolin Seeger <[email protected]>
Date: Mon Jun 23 11:25:09 2014 +0200
VERSION: Bump version up to 4.0.20.
Signed-off-by: Karolin Seeger <[email protected]>
commit 5a9c84181a76ab840fc3446fe29abde45e64d467
Merge: 989e320e23085f862571492933179726e9c5af1d
55c6deff1e06d59e4de84258c5686553133a785c
Author: Karolin Seeger <[email protected]>
Date: Mon Jun 23 11:24:48 2014 +0200
Merge tag 'samba-4.0.19' into v4-0-test
samba: tag release samba-4.0.19
-----------------------------------------------------------------------
Summary of changes:
VERSION | 2 +-
WHATSNEW.txt | 61 +++++++++++++++++++++++++++++++++++++++++++++-
source3/lib/charcnv.c | 26 +++++++++++++-------
source3/lib/system.c | 7 +----
source3/libsmb/clirap.c | 4 +-
source3/smbd/lanman.c | 4 +-
6 files changed, 83 insertions(+), 21 deletions(-)
Changeset truncated at 500 lines:
diff --git a/VERSION b/VERSION
index d89736a..f734b46 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=4
SAMBA_VERSION_MINOR=0
-SAMBA_VERSION_RELEASE=19
+SAMBA_VERSION_RELEASE=20
########################################################
# If a official release has a serious bug #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 0320288..813fca9 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,61 @@
==============================
+ Release Notes for Samba 4.0.19
+ June 23, 2014
+ ==============================
+
+
+This is a security release in order to address
+CVE-2014-0244 (Denial of service - CPU loop) and
+CVE-2014-3493 (Denial of service - Server crash/memory corruption).
+
+o CVE-2014-0244:
+ All current released versions of Samba are vulnerable to a denial of
+ service on the nmbd NetBIOS name services daemon. A malformed packet
+ can cause the nmbd server to loop the CPU and prevent any further
+ NetBIOS name service.
+
+ This flaw is not exploitable beyond causing the code to loop expending
+ CPU resources.
+
+o CVE-2014-3493:
+ All current released versions of Samba are affected by a denial of service
+ crash involving overwriting memory on an authenticated connection to the
+ smbd file server.
+
+
+Changes since 4.0.18:
+---------------------
+
+o Jeremy Allison <[email protected]>
+ * BUG 10633: CVE-2014-0244: Fix nmbd denial of service.
+ * BUG 10654: CVE-2014-3493: Fix segmentation fault in
+ smbd_marshall_dir_entry()'s SMB_FIND_FILE_UNIX handler.
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 4.0 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+ ==============================
Release Notes for Samba 4.0.18
May 27, 2014
==============================
@@ -91,8 +148,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
==============================
Release Notes for Samba 4.0.17
diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
index 1fa2c5c..dc4b110 100644
--- a/source3/lib/charcnv.c
+++ b/source3/lib/charcnv.c
@@ -46,9 +46,9 @@ void gfree_charcnv(void)
**/
size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags)
{
- size_t src_len = strlen(src);
+ size_t src_len = 0;
char *tmpbuf = NULL;
- size_t size;
+ size_t size = 0;
bool ret;
/* No longer allow a length of -1. */
@@ -62,24 +62,32 @@ size_t push_ascii(void *dest, const char *src, size_t
dest_len, int flags)
smb_panic("malloc fail");
}
if (!strupper_m(tmpbuf)) {
+ if ((flags & (STR_TERMINATE|STR_TERMINATE_ASCII)) &&
+ dest &&
+ dest_len > 0) {
+ *(char *)dest = 0;
+ }
SAFE_FREE(tmpbuf);
- return (size_t)-1;
+ return 0;
}
src = tmpbuf;
}
+ src_len = strlen(src);
if (flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) {
src_len++;
}
ret = convert_string(CH_UNIX, CH_DOS, src, src_len, dest, dest_len,
&size);
- if (ret == false &&
- (flags & (STR_TERMINATE | STR_TERMINATE_ASCII))
- && dest_len > 0) {
- ((char *)dest)[0] = '\0';
- }
SAFE_FREE(tmpbuf);
- return ret ? size : (size_t)-1;
+ if (ret == false) {
+ if ((flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) &&
+ dest_len > 0) {
+ ((char *)dest)[0] = '\0';
+ }
+ return 0;
+ }
+ return size;
}
/********************************************************************
diff --git a/source3/lib/system.c b/source3/lib/system.c
index 8252e4f..4f38597 100644
--- a/source3/lib/system.c
+++ b/source3/lib/system.c
@@ -169,6 +169,7 @@ ssize_t sys_send(int s, const void *msg, size_t len, int
flags)
/*******************************************************************
A recvfrom wrapper that will deal with EINTR.
+NB. As used with non-blocking sockets, return on EAGAIN/EWOULDBLOCK
********************************************************************/
ssize_t sys_recvfrom(int s, void *buf, size_t len, int flags, struct sockaddr
*from, socklen_t *fromlen)
@@ -177,11 +178,7 @@ ssize_t sys_recvfrom(int s, void *buf, size_t len, int
flags, struct sockaddr *f
do {
ret = recvfrom(s, buf, len, flags, from, fromlen);
-#if defined(EWOULDBLOCK)
- } while (ret == -1 && (errno == EINTR || errno == EAGAIN || errno ==
EWOULDBLOCK));
-#else
- } while (ret == -1 && (errno == EINTR || errno == EAGAIN));
-#endif
+ } while (ret == -1 && (errno == EINTR));
return ret;
}
diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c
index 40d5f67..304e01a 100644
--- a/source3/libsmb/clirap.c
+++ b/source3/libsmb/clirap.c
@@ -327,7 +327,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char
*workgroup, uint32 stype,
sizeof(param) - PTR_DIFF(p,param) - 1,
STR_TERMINATE|STR_UPPER);
- if (len == (size_t)-1) {
+ if (len == 0) {
SAFE_FREE(last_entry);
return false;
}
@@ -339,7 +339,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char
*workgroup, uint32 stype,
sizeof(param) - PTR_DIFF(p,param) - 1,
STR_TERMINATE);
- if (len == (size_t)-1) {
+ if (len == 0) {
SAFE_FREE(last_entry);
return false;
}
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 1b734a7..0a0ab6b 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -128,7 +128,7 @@ static int CopyExpanded(connection_struct *conn,
return 0;
}
l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
- if (l == -1) {
+ if (l == 0) {
return 0;
}
(*dst) += l;
@@ -143,7 +143,7 @@ static int CopyAndAdvance(char **dst, char *src, int *n)
return 0;
}
l = push_ascii(*dst,src,*n, STR_TERMINATE);
- if (l == -1) {
+ if (l == 0) {
return 0;
}
(*dst) += l;
--
Samba Shared Repository
