[SCM] Samba Shared Repository - branch master updated - release-4-0-0alpha7-1060-g37b1b9c

[Jeremy Allison]

The branch, master has been updated
       via  37b1b9cfe90c81ec64486e68867fbd024250701f (commit)
       via  d55ec4fd237ef6ebea2ee9a55c7d85dfe21f7737 (commit)
      from  265829c32fdeea2d00a75a21b4225211b24ea62d (commit)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 37b1b9cfe90c81ec64486e68867fbd024250701f
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Apr 16 16:21:31 2009 -0700

    Add torture tester to ensure we don't regress the ulogoff bug.
    Jeremy.

commit d55ec4fd237ef6ebea2ee9a55c7d85dfe21f7737
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Apr 16 16:19:10 2009 -0700

    Fix bug found by Tim Prouty, logging off and then re-using a vuid can cause smbd to
    access a freed structure.
    Jeremy.

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/uid.c        |   11 +++++++++++
 source3/torture/torture.c |   45 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 0 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index f8c55b1..b8ed321 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -164,6 +164,10 @@ void conn_clear_vuid_cache(connection_struct *conn, uint16_t vuid)
 
 		if (ent->vuid == vuid) {
 			ent->vuid = UID_FIELD_INVALID;
+			/* Ensure we're not freeing an active pointer. */
+			if (conn->server_info == ent->server_info) {
+				conn->server_info = NULL;
+			}
 			TALLOC_FREE(ent->server_info);
 			ent->read_only = False;
 			ent->admin_user = False;
@@ -216,6 +220,13 @@ bool change_to_user(connection_struct *conn, uint16 vuid)
 
 	server_info = vuser ? vuser->server_info : conn->server_info;
 
+	if (!server_info) {
+		/* Invalid vuid sent - even with security = share. */
+		DEBUG(2,("change_to_user: Invalid vuid %d used on "
+			 "share %s.\n",vuid, lp_servicename(snum) ));
+		return false;
+	}
+
 	if (!check_user_ok(conn, vuid, server_info, snum)) {
 		DEBUG(2,("change_to_user: SMB user %s (unix user %s, vuid %d) "
 			 "not permitted access to share %s.\n",
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 804e772..3335830 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -5199,6 +5199,50 @@ static bool run_cli_echo(int dummy)
 	return NT_STATUS_IS_OK(status);
 }
 
+static bool run_uid_regression_test(int dummy)
+{
+	static struct cli_state *cli;
+	int16_t old_vuid;
+	bool correct = True;
+
+	printf("starting uid regression test\n");
+
+	if (!torture_open_connection(&cli, 0)) {
+		return False;
+	}
+
+	cli_sockopt(cli, sockops);
+
+	/* Ok - now save then logoff our current user. */
+	old_vuid = cli->vuid;
+
+	if (!cli_ulogoff(cli)) {
+		d_printf("(%s) cli_ulogoff failed: %s\n",
+			__location__, cli_errstr(cli));
+		correct = false;
+		goto out;
+	}
+
+	cli->vuid = old_vuid;
+
+	/* Try an operation. */
+	if (!cli_mkdir(cli, "\\uid_reg_test")) {
+		/* We expect bad uid. */
+		if (!check_error(__LINE__, cli, ERRSRV, ERRbaduid,
+				NT_STATUS_NO_SUCH_USER)) {
+			return False;
+		}
+		goto out;
+	}
+
+	cli_rmdir(cli, "\\uid_reg_test");
+
+  out:
+
+	torture_close_connection(cli);
+	return correct;
+}
+
 static bool run_local_substitute(int dummy)
 {
 	bool ok = true;
@@ -5778,6 +5822,7 @@ static struct {
 	{"RW3",  run_readwritelarge, 0},
 	{"OPEN", run_opentest, 0},
 	{"POSIX", run_simple_posix_open_test, 0},
+	{ "UID-REGRESSION-TEST", run_uid_regression_test, 0},
 #if 1
 	{"OPENATTR", run_openattrtest, 0},
 #endif


-- 
Samba Shared Repository