[SCM] Samba Shared Repository - branch v3-2-test updated - initial-v3-2-test-2400-gf1fb9fd

[Michael Adam]

The branch, v3-2-test has been updated
       via  f1fb9fd6f14fc53629871cbe4b8558ad5acc14f0 (commit)
       via  ba69097f37086537e6b2606fceeb874f6d3e4e1c (commit)
       via  00e2dd36b38fcf92d76a0e79860cf9ca6a3d027e (commit)
      from  1cb2d980d3b2759d73314b112c904f5e20052135 (commit)

http://gitweb.samba.org/?samba.git;a=shortlog;h=v3-2-test


- Log -----------------------------------------------------------------
commit f1fb9fd6f14fc53629871cbe4b8558ad5acc14f0
Author: Michael Adam <obnox at samba.org>
Date:   Mon Feb 18 17:38:19 2008 +0100

    Fix segfault in svcctl_get_secdesc(): prevent premature TALLOC_FREE.
    
    This crash was triggered by (e.g.) net rpc service status.
    This patch prevents premature freeing of memory and creates a
    common exit point to the function.
    
    Michael

commit ba69097f37086537e6b2606fceeb874f6d3e4e1c
Author: Michael Adam <obnox at samba.org>
Date:   Mon Feb 18 17:23:41 2008 +0100

    Add a check for success of fetch_reg_values().
    
    Michael

commit 00e2dd36b38fcf92d76a0e79860cf9ca6a3d027e
Author: Michael Adam <obnox at samba.org>
Date:   Mon Feb 18 16:58:24 2008 +0100

    Fix a comment typo.
    
    Michael

-----------------------------------------------------------------------

Summary of changes:
 source/services/services_db.c |   32 ++++++++++++++++++--------------
 1 files changed, 18 insertions(+), 14 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source/services/services_db.c b/source/services/services_db.c
index d4e144d..ae83e72 100644
--- a/source/services/services_db.c
+++ b/source/services/services_db.c
@@ -469,7 +469,7 @@ void svcctl_init_keys( void )
 
 	fetch_reg_keys( key, subkeys );
 
-	/* the builting services exist */
+	/* the builtin services exist */
 
 	for ( i=0; builtin_svcs[i].servicename; i++ )
 		add_new_svc_name( key, subkeys, builtin_svcs[i].servicename );
@@ -520,25 +520,21 @@ SEC_DESC *svcctl_get_secdesc( TALLOC_CTX *ctx, const char *name, NT_USER_TOKEN *
 	if ( !W_ERROR_IS_OK(wresult) ) {
 		DEBUG(0,("svcctl_get_secdesc: key lookup failed! [%s] (%s)\n",
 			path, dos_errstr(wresult)));
-		SAFE_FREE(path);
-		return NULL;
+		goto done;
 	}
-	SAFE_FREE(path);
 
 	if ( !(values = TALLOC_ZERO_P( key, REGVAL_CTR )) ) {
 		DEBUG(0,("svcctl_get_secdesc: talloc() failed!\n"));
-		TALLOC_FREE( key );
-		return NULL;
+		goto done;
 	}
 
-	fetch_reg_values( key, values );
-
-	TALLOC_FREE(key);
+	if (fetch_reg_values( key, values ) == -1) {
+		DEBUG(0, ("Error getting registry values\n"));
+		goto done;
+	}
 
 	if ( !(val = regval_ctr_getvalue( values, "Security" )) ) {
-		DEBUG(6,("svcctl_get_secdesc: constructing default secdesc for service [%s]\n", 
-			name));
-		return construct_service_sd( ctx );
+		goto fallback_to_default_sd;
 	}
 
 	/* stream the service security descriptor */
@@ -546,10 +542,18 @@ SEC_DESC *svcctl_get_secdesc( TALLOC_CTX *ctx, const char *name, NT_USER_TOKEN *
 	status = unmarshall_sec_desc(ctx, regval_data_p(val),
 				     regval_size(val), &ret_sd);
 
-	if (!NT_STATUS_IS_OK(status)) {
-		return construct_service_sd( ctx );
+	if (NT_STATUS_IS_OK(status)) {
+		goto done;
 	}
 
+fallback_to_default_sd:
+	DEBUG(6, ("svcctl_get_secdesc: constructing default secdesc for "
+		  "service [%s]\n", name));
+	ret_sd = construct_service_sd(ctx);
+
+done:
+	SAFE_FREE(path);
+	TALLOC_FREE(key);
 	return ret_sd;
 }
 


-- 
Samba Shared Repository