The branch, master has been updated
via 457d79f s3: smbd - fix processing of packets with invalid DOS
charset conversions.
via d77a742 s3: nmbd: Fix bug 10633 - nmbd denial of service
from d097898 ctdb-build: Instead of default test_wrap, install fixed
test_wrap
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 457d79f2cb83f3f5c3f8d64ed99f9b1ea0185d3f
Author: Jeremy Allison <[email protected]>
Date: Sat Jun 7 21:51:44 2014 -0700
s3: smbd - fix processing of packets with invalid DOS charset conversions.
CVE-2014-3493
Bug 10654 - Segmentation fault in smbd_marshall_dir_entry()'s
SMB_FIND_FILE_UNIX handler
https://bugzilla.samba.org/show_bug.cgi?id=10654
Signed-off-by: Jeremy Allison <[email protected]>
Reviewed-by: Volker Lendecke <[email protected]>
Reviewed-by: Guenther Deschner <[email protected]>
Autobuild-User(master): Jeremy Allison <[email protected]>
Autobuild-Date(master): Wed Jun 25 03:47:55 CEST 2014 on sn-devel-104
commit d77a74237e660dd2ce9f1e14b02635f8a2569653
Author: Jeremy Allison <[email protected]>
Date: Wed May 28 10:40:27 2014 -0700
s3: nmbd: Fix bug 10633 - nmbd denial of service
The Linux kernel has a bug in that it can give spurious
wakeups on a non-blocking UDP socket for a non-deliverable packet.
When nmbd was changed to use non-blocking sockets it
became vulnerable to a spurious wakeup from poll/epoll.
Fix sys_recvfile() to return on EWOULDBLOCK/EAGAIN.
CVE-2014-0244
https://bugzilla.samba.org/show_bug.cgi?id=10633
Signed-off-by: Jeremy Allison <[email protected]>
Reviewed-by: Andreas Schneider <[email protected]>
-----------------------------------------------------------------------
Summary of changes:
source3/lib/charcnv.c | 26 +++++++++++++++++---------
source3/lib/system.c | 7 ++-----
source3/libsmb/clirap.c | 4 ++--
source3/smbd/lanman.c | 4 ++--
4 files changed, 23 insertions(+), 18 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
index 71d2c3a..2189812 100644
--- a/source3/lib/charcnv.c
+++ b/source3/lib/charcnv.c
@@ -46,9 +46,9 @@ void gfree_charcnv(void)
**/
size_t push_ascii(void *dest, const char *src, size_t dest_len, int flags)
{
- size_t src_len = strlen(src);
+ size_t src_len = 0;
char *tmpbuf = NULL;
- size_t size;
+ size_t size = 0;
bool ret;
/* No longer allow a length of -1. */
@@ -62,24 +62,32 @@ size_t push_ascii(void *dest, const char *src, size_t
dest_len, int flags)
smb_panic("malloc fail");
}
if (!strupper_m(tmpbuf)) {
+ if ((flags & (STR_TERMINATE|STR_TERMINATE_ASCII)) &&
+ dest &&
+ dest_len > 0) {
+ *(char *)dest = 0;
+ }
SAFE_FREE(tmpbuf);
- return (size_t)-1;
+ return 0;
}
src = tmpbuf;
}
+ src_len = strlen(src);
if (flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) {
src_len++;
}
ret = convert_string(CH_UNIX, CH_DOS, src, src_len, dest, dest_len,
&size);
- if (ret == false &&
- (flags & (STR_TERMINATE | STR_TERMINATE_ASCII))
- && dest_len > 0) {
- ((char *)dest)[0] = '\0';
- }
SAFE_FREE(tmpbuf);
- return ret ? size : (size_t)-1;
+ if (ret == false) {
+ if ((flags & (STR_TERMINATE | STR_TERMINATE_ASCII)) &&
+ dest_len > 0) {
+ ((char *)dest)[0] = '\0';
+ }
+ return 0;
+ }
+ return size;
}
/********************************************************************
diff --git a/source3/lib/system.c b/source3/lib/system.c
index af72b2a..698de12 100644
--- a/source3/lib/system.c
+++ b/source3/lib/system.c
@@ -169,6 +169,7 @@ ssize_t sys_send(int s, const void *msg, size_t len, int
flags)
/*******************************************************************
A recvfrom wrapper that will deal with EINTR.
+NB. As used with non-blocking sockets, return on EAGAIN/EWOULDBLOCK
********************************************************************/
ssize_t sys_recvfrom(int s, void *buf, size_t len, int flags, struct sockaddr
*from, socklen_t *fromlen)
@@ -177,11 +178,7 @@ ssize_t sys_recvfrom(int s, void *buf, size_t len, int
flags, struct sockaddr *f
do {
ret = recvfrom(s, buf, len, flags, from, fromlen);
-#if defined(EWOULDBLOCK)
- } while (ret == -1 && (errno == EINTR || errno == EAGAIN || errno ==
EWOULDBLOCK));
-#else
- } while (ret == -1 && (errno == EINTR || errno == EAGAIN));
-#endif
+ } while (ret == -1 && (errno == EINTR));
return ret;
}
diff --git a/source3/libsmb/clirap.c b/source3/libsmb/clirap.c
index 036919f..64e3767 100644
--- a/source3/libsmb/clirap.c
+++ b/source3/libsmb/clirap.c
@@ -327,7 +327,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char
*workgroup, uint32 stype,
sizeof(param) - PTR_DIFF(p,param) - 1,
STR_TERMINATE|STR_UPPER);
- if (len == (size_t)-1) {
+ if (len == 0) {
SAFE_FREE(last_entry);
return false;
}
@@ -339,7 +339,7 @@ bool cli_NetServerEnum(struct cli_state *cli, char
*workgroup, uint32 stype,
sizeof(param) - PTR_DIFF(p,param) - 1,
STR_TERMINATE);
- if (len == (size_t)-1) {
+ if (len == 0) {
SAFE_FREE(last_entry);
return false;
}
diff --git a/source3/smbd/lanman.c b/source3/smbd/lanman.c
index 63c2ad7..66ab8a2 100644
--- a/source3/smbd/lanman.c
+++ b/source3/smbd/lanman.c
@@ -128,7 +128,7 @@ static int CopyExpanded(connection_struct *conn,
return 0;
}
l = push_ascii(*dst,buf,*p_space_remaining, STR_TERMINATE);
- if (l == -1) {
+ if (l == 0) {
return 0;
}
(*dst) += l;
@@ -143,7 +143,7 @@ static int CopyAndAdvance(char **dst, char *src, int *n)
return 0;
}
l = push_ascii(*dst,src,*n, STR_TERMINATE);
- if (l == -1) {
+ if (l == 0) {
return 0;
}
(*dst) += l;
--
Samba Shared Repository
