[SCM] Samba Shared Repository - branch v3-3-test updated - release-3-2-0pre2-4601-g8b49bf0

Jeremy Allison jra at samba.org
Fri Dec 5 21:19:15 GMT 2008


The branch, v3-3-test has been updated
       via  8b49bf06e252b3c37ba910f8b887f48232eb1a9b (commit)
      from  a679d0e96ec54f4660537966b31ce2f56d5a1ea9 (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-3-test


- Log -----------------------------------------------------------------
commit 8b49bf06e252b3c37ba910f8b887f48232eb1a9b
Author: Volker Lendecke <Volker.Lendecke at SerNet.DE>
Date:   Fri Dec 5 13:17:49 2008 -0800

    Fix for crash bug freeing a non-malloc'ed buffer if the client sends a non-encrypted packet with the crypto state set.

-----------------------------------------------------------------------

Summary of changes:
 source/libsmb/smb_seal.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source/libsmb/smb_seal.c b/source/libsmb/smb_seal.c
index a81ae9a..795c8bc 100644
--- a/source/libsmb/smb_seal.c
+++ b/source/libsmb/smb_seal.c
@@ -388,10 +388,17 @@ void common_free_encryption_state(struct smb_trans_enc_state **pp_es)
 
 void common_free_enc_buffer(struct smb_trans_enc_state *es, char *buf)
 {
+	uint16_t enc_ctx_num;
+
 	if (!common_encryption_on(es)) {
 		return;
 	}
 
+	if (!NT_STATUS_IS_OK(get_enc_ctx_num((const uint8_t *)buf,
+			&enc_ctx_num))) {
+		return;
+	}
+
 	if (es->smb_enc_type == SMB_TRANS_ENC_NTLM) {
 		SAFE_FREE(buf);
 		return;


-- 
Samba Shared Repository


More information about the samba-cvs mailing list