The branch, master has been updated
via 68380ebaa60 winbindd: Fix a use-after-free when winbind clients exit
from dd1f750293e s3: lib: Paranoia around use of snprintf copying into a
fixed-size buffer from a getenv() pointer.
https://git.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 68380ebaa60c64311cc1081f700d571abbf69f4f
Author: Volker Lendecke <[email protected]>
Date: Fri May 15 15:19:45 2020 +0200
winbindd: Fix a use-after-free when winbind clients exit
Bug: https://bugzilla.samba.org/show_bug.cgi?id=14382
Pair-Programmed-With: Stefan Metzmacher <[email protected]>
Signed-off-by: Volker Lendecke <[email protected]>
Signed-off-by: Stefan Metzmacher <[email protected]>
Autobuild-User(master): Stefan Metzmacher <[email protected]>
Autobuild-Date(master): Tue May 19 10:45:06 UTC 2020 on sn-devel-184
-----------------------------------------------------------------------
Summary of changes:
source3/winbindd/winbindd_dual.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
Changeset truncated at 500 lines:
diff --git a/source3/winbindd/winbindd_dual.c b/source3/winbindd/winbindd_dual.c
index 8ad2485324e..47efe988d65 100644
--- a/source3/winbindd/winbindd_dual.c
+++ b/source3/winbindd/winbindd_dual.c
@@ -202,7 +202,32 @@ struct tevent_req *wb_child_request_send(TALLOC_CTX
*mem_ctx,
state->ev = ev;
state->child = child;
- state->request = request;
+
+ /*
+ * We have to make a copy of "request", because our caller
+ * might drop us via talloc_free().
+ *
+ * The talloc_move() magic in wb_child_request_cleanup() keeps
+ * all the requests, but if we are sitting deep within
+ * writev_send() down to the client, we have given it the
+ * pointer to "request". As our caller lost interest, it will
+ * just free "request", while writev_send still references it.
+ */
+
+ state->request = talloc_memdup(state, request, sizeof(*request));
+ if (tevent_req_nomem(state->request, req)) {
+ return tevent_req_post(req, ev);
+ }
+
+ if (request->extra_data.data != NULL) {
+ state->request->extra_data.data = talloc_memdup(
+ state->request,
+ request->extra_data.data,
+ request->extra_len);
+ if (tevent_req_nomem(state->request->extra_data.data, req)) {
+ return tevent_req_post(req, ev);
+ }
+ }
subreq = tevent_queue_wait_send(state, ev, child->queue);
if (tevent_req_nomem(subreq, req)) {
@@ -330,6 +355,7 @@ static void wb_child_request_cleanup(struct tevent_req *req,
subreq = talloc_move(state->child->queue, &state->subreq);
talloc_move(subreq, &state->queue_subreq);
+ talloc_move(subreq, &state->request);
tevent_req_set_callback(subreq,
wb_child_request_orphaned,
state->child);
--
Samba Shared Repository
