[SCM] Samba Shared Repository - branch v3-4-stable updated
Karolin Seeger
kseeger at samba.org
Mon Jan 18 04:38:37 MST 2010
The branch, v3-4-stable has been updated
via 6ac4141... WHATSNEW: Update changes.
via 04922a5... s3: Fix a crash in libsmbclient used against the OpenSolaris CIFS server
via 724d642... Fix bug 7045 - Bad (non memory copying) interfaces in smbc_setXXXX calls.
via 7eff7ca... WHATSNEW: Update changes since 3.4.4.
via 53a601f... s3-libsmbclient: Fix crash bug in SMBC_parse_path().
via 41b5680... docs: add -K option to the pdbedit manpage.
via 56ca077... Fix bug #7036 - net rpc getsid fails in hardened windows environments.
via 8b5a4f6... Fix bug #7034 - vfs_cap causes signal 11 (SIGSEGV) (cherry picked from commit ca847952054f5bbde1d40ad4260589b6fcc9721d) (cherry picked from commit 62bed0de7f6dbde183c3002253008941c4b88b3f)
via dc92cbb... smbd: Fix opening the quota magic file
via 5eec352... Re-fix bug 5202 - cannot change ACLs on writable file with "dos filemode=yes"
via ed27534... Second part of the fix for bug #7020 - smbd using 2G memory.
via bb064b9... Fix bug #7020 - smbd using 2G memory.
via e68c574... WHATSNEW: Start release notes for 3.4.5.
via 3b05073... VERSION: Raise version number up to 3.4.5.
from 656624f... WHATSNEW: Update changes.
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable
- Log -----------------------------------------------------------------
commit 6ac41410868711200442413dad6461771cda977b
Author: Karolin Seeger <kseeger at samba.org>
Date: Mon Jan 18 12:37:16 2010 +0100
WHATSNEW: Update changes.
Karolin
(cherry picked from commit fb7af5cfcf4f8c45e4c56f85a82eb93647068c8b)
commit 04922a546878687f6684b403f4fd250c03033e9d
Author: Volker Lendecke <vl at samba.org>
Date: Sat Jan 16 13:31:44 2010 +0100
s3: Fix a crash in libsmbclient used against the OpenSolaris CIFS server
A user has sent me a sniff where the OpenSolaris CIFS server returns "32" in
totalentries, but the array in ctr only contains 15 entries. Look at the right
delimiter for walking the array.
Fix bug #7046 (libsmbclient crash against OpenSolaris CIFS server).
(cherry picked from commit 734446bb3a8984ec805c73e06e553312b46e4094)
commit 724d6423c961e01745128dbc58c7946f1e36b043
Author: Jeremy Allison <jra at samba.org>
Date: Fri Jan 15 17:49:56 2010 -0800
Fix bug 7045 - Bad (non memory copying) interfaces in smbc_setXXXX calls.
In smbc_free_context libsmbclient just called free() on the string options
so it assumes the callers have malloced them before setting them via smbc_set
calls.
Change to correctly malloc/free string options to the library.
Protect against SMB_STRDUP of null.
Contains 2d41b1ab78639abe4ae030ff482573f464564dd7 and
f85b6ee90b88c7f7b2a92c8a5f3e2ebe59c1087b from master.
Jeremy
(cherry picked from commit 1d9dc38aec417c8ccc9fa34d32015ee57d877ba9)
commit 7eff7ca9c099e887bbedc15ed973e83a0ab47712
Author: Karolin Seeger <kseeger at samba.org>
Date: Fri Jan 15 15:26:20 2010 +0100
WHATSNEW: Update changes since 3.4.4.
Karolin
(cherry picked from commit b8ff43eedef4315595e6b4c4467e8e2d8d19ffc4)
commit 53a601ff30fa7b6cf2014b1b09a9736ea9b36399
Author: Günther Deschner <gd at samba.org>
Date: Thu Jan 14 19:34:26 2010 +0100
s3-libsmbclient: Fix crash bug in SMBC_parse_path().
Patch from Tim Waugh <twaugh at redhat.com>.
This resolves https://bugzilla.redhat.com/show_bug.cgi?id=552658
LIBSMBCLIENT-OPENDIR torture test checks this as well.
Guenther
(cherry picked from commit e635b0074c55e0376495abe940355aa7b04f0b70)
Fix bug #7043 (SIGSEGV in "SMBC_parse_path").
(cherry picked from commit 01009416998219a27268211a3ae26d7b3ab157f8)
commit 41b56802df244a45bae188e186323f86c2a38531
Author: Michael Adam <obnox at samba.org>
Date: Tue Jan 12 08:39:36 2010 +0100
docs: add -K option to the pdbedit manpage.
Thanks to Oota Toshiya <t-oota at dh.jp.nec.com> for pointing this out!
Michael
Fix bug #7041.
(cherry picked from commit 918045b22b1607acf51c40d8c8765862f3400a1d)
commit 56ca0778fb492e60ec64307f06a8ec84b5889561
Author: Jeremy Allison <jra at samba.org>
Date: Thu Jan 14 15:39:30 2010 -0800
Fix bug #7036 - net rpc getsid fails in hardened windows environments.
Fix suggested by Dave.Daugherty at Centrify.com.
(cherry picked from commit 6653cc43233381a941cdd85550f04b087fe880ff)
(cherry picked from commit 59b46630ac205bdfe409c0c8b60dc5f5ddad5cf1)
commit 8b5a4f62106616431ee32cc85cd5186c704dbc44
Author: SASAJIMA Toshihiro <sasajima_t at jp.fujitsu.com>
Date: Tue Jan 12 21:43:23 2010 -0800
Fix bug #7034 - vfs_cap causes signal 11 (SIGSEGV) (cherry picked from commit ca847952054f5bbde1d40ad4260589b6fcc9721d)
(cherry picked from commit 62bed0de7f6dbde183c3002253008941c4b88b3f)
commit dc92cbbe3a1c26e6e98794ff9ce6e7bbdcceedd8
Author: Stefan Metzmacher <metze at samba.org>
Date: Mon Dec 21 16:26:34 2009 +0100
smbd: Fix opening the quota magic file
This fixes bug #6642 and bug #6919.
metze
(cherry picked from commit 7fd0767c6abdc9f4c456ae0a7d247f3a25ffcbd9)
commit 5eec35292802b55fb29f3016627f0ec767db7df0
Author: Jeremy Allison <jra at samba.org>
Date: Fri Jan 8 10:22:46 2010 -0800
Re-fix bug 5202 - cannot change ACLs on writable file with "dos filemode=yes"
This bug re-occurred for 3.3.x and above.
The reason is that to change a NT ACL we now have to open the file requesting
WRITE_DAC and WRITE_OWNER access. The mapping from POSIX "w" to NT permissions
in posix_acls doesn't add these bits when "dos filemode = yes", so even though
the permission or owner change would be allowed by the POSIX ACL code, the
NTCreateX call fails with ACCESS_DENIED now we always check NT permissions
first.
Added in the mapping from "w" to WRITE_DAC and WRITE_OWNER access.
Jeremy.
(cherry picked from commit f04a8d1811c1099eb653efda314bc98553fa6d02)
commit ed275341a97a4e996aa1dcfa8a8812fd223d6efc
Author: Jeremy Allison <jra at samba.org>
Date: Wed Jan 6 13:29:35 2010 -0800
Second part of the fix for bug #7020 - smbd using 2G memory.
There was a second leak in the processing of the out_data.frag
prs_struct. It needs freeing once the current pdu has been returned
asynchronously.
Jeremy.
(cherry picked from commit 3c092c7acb18620e3769c791a9ea4055605247ee)
commit bb064b9936f58b5fe478e5743fb4ed8cfe03ce35
Author: Jeremy Allison <jra at samba.org>
Date: Tue Jan 5 14:38:56 2010 -0800
Fix bug #7020 - smbd using 2G memory.
When deferring an async pipe writeX and readX transfer
the outstanding request struct onto the conn struct. This
needs freeing after the packet is finally processed.
Jeremy.
(cherry picked from commit cabe8f0ee859013d49fba011a5a9ac0112d7b001)
commit e68c57483435673a90a558c898dc8a1aebe9b231
Author: Karolin Seeger <kseeger at samba.org>
Date: Mon Jan 11 12:05:54 2010 +0100
WHATSNEW: Start release notes for 3.4.5.
Karolin
(cherry picked from commit 6a448ef299b24d3d02bb402c54105affd8e92b85)
commit 3b050737be88f3cbbc371d7842fc848dcbbd40fa
Author: Karolin Seeger <kseeger at samba.org>
Date: Mon Jan 11 12:03:45 2010 +0100
VERSION: Raise version number up to 3.4.5.
Karolin
(cherry picked from commit 459d41e5fc651a0820a7a1b571179d81b4546df3)
-----------------------------------------------------------------------
Summary of changes:
WHATSNEW.txt | 74 ++++++++++++++++++++++++++++++++++++-
docs-xml/manpages-3/pdbedit.8.xml | 1 +
source3/VERSION | 2 +-
source3/libsmb/libsmb_context.c | 26 +++++++++---
source3/libsmb/libsmb_dir.c | 2 +-
source3/libsmb/libsmb_path.c | 2 +-
source3/libsmb/libsmb_setget.c | 15 ++++++-
source3/modules/vfs_cap.c | 3 +-
source3/rpc_server/srv_pipe_hnd.c | 7 +++
source3/smbd/pipes.c | 10 +++++
source3/smbd/posix_acls.c | 3 +
source3/smbd/reply.c | 15 +++++--
source3/utils/net_rpc.c | 8 +++-
13 files changed, 146 insertions(+), 22 deletions(-)
Changeset truncated at 500 lines:
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 18d0d31..1fa0358 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,74 @@
=============================
+ Release Notes for Samba 3.4.5
+ January 19, 2010
+ =============================
+
+
+This is the latest stable release of Samba 3.4.
+
+Major enhancements in Samba 3.4.5 include:
+
+ o Fix memory in leak in smbd (bug #7020).
+ o Fix changing of ACLs on writable files with "dos filemode=yes" (bug #5202).
+
+
+######################################################################
+Changes
+#######
+
+Changes since 3.4.4
+-------------------
+
+
+o Jeremy Allison <jra at samba.org>
+ * BUG 5202: Fix changing of ACLs on writable files with "dos filemode=yes".
+ * BUG 7020: Fix memory leak in smbd.
+ * BUG 7036: Fix 'net rpc getsid' in hardened Windows environments.
+ * BUG 7045: Fix bad (non memory copying) interfaces in smbc_setXXXX calls.
+
+
+o Günther Deschner <gd at samba.org>
+ * BUG 7043: Fix crash bug in "SMBC_parse_path".
+
+
+o Volker Lendecke <vl at samba.org>
+ * BUG 7046: Fix a crash in libsmbclient used against the OpenSolaris CIFS
+ server.
+
+
+o Stefan Metzmacher <metze at samba.org>
+ * BUG 6642: Fix opening the quota magic file.
+ * BUG 6919: Fix remote quota management.
+
+
+o SASAJIMA Toshihiro <sasajima_t at jp.fujitsu.com>
+ * BUG 7034: Fix internal error caused by vfs_cap.
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored. All bug reports should
+be filed under the Samba 3.4 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older versions follow:
+----------------------------------------
+
+ =============================
Release Notes for Samba 3.4.4
January 7, 2009
=============================
@@ -94,8 +164,8 @@ database (https://bugzilla.samba.org/).
======================================================================
-Release notes for older versions follow:
-----------------------------------------
+----------------------------------------------------------------------
+
=============================
Release Notes for Samba 3.4.3
diff --git a/docs-xml/manpages-3/pdbedit.8.xml b/docs-xml/manpages-3/pdbedit.8.xml
index 9242d67..f6b5d2e 100644
--- a/docs-xml/manpages-3/pdbedit.8.xml
+++ b/docs-xml/manpages-3/pdbedit.8.xml
@@ -28,6 +28,7 @@
<arg choice="opt">-D drive</arg>
<arg choice="opt">-S script</arg>
<arg choice="opt">-p profile</arg>
+ <arg choice="opt">-K</arg>
<arg choice="opt">-a</arg>
<arg choice="opt">-t, --password-from-stdin</arg>
<arg choice="opt">-m</arg>
diff --git a/source3/VERSION b/source3/VERSION
index 135a82c..a7d0bbf 100644
--- a/source3/VERSION
+++ b/source3/VERSION
@@ -25,7 +25,7 @@
########################################################
SAMBA_VERSION_MAJOR=3
SAMBA_VERSION_MINOR=4
-SAMBA_VERSION_RELEASE=4
+SAMBA_VERSION_RELEASE=5
########################################################
# Bug fix releases use a letter for the patch revision #
diff --git a/source3/libsmb/libsmb_context.c b/source3/libsmb/libsmb_context.c
index f85f2df..09e1ab8 100644
--- a/source3/libsmb/libsmb_context.c
+++ b/source3/libsmb/libsmb_context.c
@@ -192,13 +192,8 @@ smbc_free_context(SMBCCTX *context,
}
/* Things we have to clean up */
- free(smbc_getWorkgroup(context));
smbc_setWorkgroup(context, NULL);
-
- free(smbc_getNetbiosName(context));
smbc_setNetbiosName(context, NULL);
-
- free(smbc_getUser(context));
smbc_setUser(context, NULL);
DEBUG(3, ("Context %p successfully freed\n", context));
@@ -426,7 +421,6 @@ SMBCCTX *
smbc_init_context(SMBCCTX *context)
{
int pid;
- char *user = NULL;
char *home = NULL;
if (!context) {
@@ -535,7 +529,7 @@ smbc_init_context(SMBCCTX *context)
/*
* FIXME: Is this the best way to get the user info?
*/
- user = getenv("USER");
+ char *user = getenv("USER");
/* walk around as "guest" if no username can be found */
if (!user) {
user = SMB_STRDUP("guest");
@@ -549,6 +543,12 @@ smbc_init_context(SMBCCTX *context)
}
smbc_setUser(context, user);
+ SAFE_FREE(user);
+
+ if (!smbc_getUser(context)) {
+ errno = ENOMEM;
+ return NULL;
+ }
}
if (!smbc_getNetbiosName(context)) {
@@ -581,6 +581,12 @@ smbc_init_context(SMBCCTX *context)
}
smbc_setNetbiosName(context, netbios_name);
+ SAFE_FREE(netbios_name);
+
+ if (!smbc_getNetbiosName(context)) {
+ errno = ENOMEM;
+ return NULL;
+ }
}
DEBUG(1, ("Using netbios name %s.\n", smbc_getNetbiosName(context)));
@@ -602,6 +608,12 @@ smbc_init_context(SMBCCTX *context)
}
smbc_setWorkgroup(context, workgroup);
+ SAFE_FREE(workgroup);
+
+ if (!smbc_getWorkgroup(context)) {
+ errno = ENOMEM;
+ return NULL;
+ }
}
DEBUG(1, ("Using workgroup %s.\n", smbc_getWorkgroup(context)));
diff --git a/source3/libsmb/libsmb_dir.c b/source3/libsmb/libsmb_dir.c
index 143c61c..3884f23 100644
--- a/source3/libsmb/libsmb_dir.c
+++ b/source3/libsmb/libsmb_dir.c
@@ -303,7 +303,7 @@ net_share_enum_rpc(struct cli_state *cli,
}
/* For each returned entry... */
- for (i = 0; i < total_entries; i++) {
+ for (i = 0; i < info_ctr.ctr.ctr1->count; i++) {
/* pull out the share name */
fstrcpy(name, info_ctr.ctr.ctr1->array[i].name);
diff --git a/source3/libsmb/libsmb_path.c b/source3/libsmb/libsmb_path.c
index 6a59a12..511d54e 100644
--- a/source3/libsmb/libsmb_path.c
+++ b/source3/libsmb/libsmb_path.c
@@ -308,7 +308,7 @@ SMBC_parse_path(TALLOC_CTX *ctx,
if (!*pp_server) {
return -1;
}
- *pp_server[wl] = '\0';
+ (*pp_server)[wl] = '\0';
return 0;
}
diff --git a/source3/libsmb/libsmb_setget.c b/source3/libsmb/libsmb_setget.c
index 3493e4f..7113c62 100644
--- a/source3/libsmb/libsmb_setget.c
+++ b/source3/libsmb/libsmb_setget.c
@@ -39,7 +39,10 @@ smbc_getNetbiosName(SMBCCTX *c)
void
smbc_setNetbiosName(SMBCCTX *c, char * netbios_name)
{
- c->netbios_name = netbios_name;
+ SAFE_FREE(c->netbios_name);
+ if (netbios_name) {
+ c->netbios_name = SMB_STRDUP(netbios_name);
+ }
}
/** Get the workgroup used for making connections */
@@ -53,7 +56,10 @@ smbc_getWorkgroup(SMBCCTX *c)
void
smbc_setWorkgroup(SMBCCTX *c, char * workgroup)
{
- c->workgroup = workgroup;
+ SAFE_FREE(c->workgroup);
+ if (workgroup) {
+ c->workgroup = SMB_STRDUP(workgroup);
+ }
}
/** Get the username used for making connections */
@@ -67,7 +73,10 @@ smbc_getUser(SMBCCTX *c)
void
smbc_setUser(SMBCCTX *c, char * user)
{
- c->user = user;
+ SAFE_FREE(c->user);
+ if (user) {
+ c->user = SMB_STRDUP(user);
+ }
}
/** Get the debug level */
diff --git a/source3/modules/vfs_cap.c b/source3/modules/vfs_cap.c
index e26d29d..954e6fb 100644
--- a/source3/modules/vfs_cap.c
+++ b/source3/modules/vfs_cap.c
@@ -600,12 +600,13 @@ static char *capdecode(TALLOC_CTX *ctx, const char *from)
size_t len = 0;
for (p1 = from; *p1; len++) {
- if (is_hex(from)) {
+ if (is_hex(p1)) {
p1 += 3;
} else {
p1++;
}
}
+ len++;
to = TALLOC_ARRAY(ctx, char, len);
if (!to) {
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index ffb7dde..14b137b 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -890,6 +890,13 @@ static ssize_t read_from_internal_pipe(struct pipes_struct *p, char *data, size_
out:
(*is_data_outstanding) = prs_offset(&p->out_data.frag) > n;
+ if (p->out_data.current_pdu_sent == prs_offset(&p->out_data.frag)) {
+ /* We've returned everything in the out_data.frag
+ * so we're done with this pdu. Free it and reset
+ * current_pdu_sent. */
+ p->out_data.current_pdu_sent = 0;
+ prs_mem_free(&p->out_data.frag);
+ }
return data_returned;
}
diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index 2686cf4..878d171 100644
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -326,6 +326,11 @@ static void pipe_write_andx_done(struct tevent_req *subreq)
done:
chain_reply(req);
+ /*
+ * We must free here as the ownership of req was
+ * moved to the connection struct in reply_pipe_write_and_X().
+ */
+ TALLOC_FREE(req);
}
/****************************************************************************
@@ -431,4 +436,9 @@ static void pipe_read_andx_done(struct tevent_req *subreq)
done:
chain_reply(req);
+ /*
+ * We must free here as the ownership of req was
+ * moved to the connection struct in reply_pipe_read_and_X().
+ */
+ TALLOC_FREE(req);
}
diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index 3b6f70b..43edf21 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1107,6 +1107,9 @@ static uint32_t map_canon_ace_perms(int snum,
nt_mask |= ((perms & S_IWUSR) ? UNIX_ACCESS_W : 0 );
nt_mask |= ((perms & S_IXUSR) ? UNIX_ACCESS_X : 0 );
}
+ if ((perms & S_IWUSR) && lp_dos_filemode(snum)) {
+ nt_mask |= (SEC_STD_WRITE_DAC|SEC_STD_WRITE_OWNER);
+ }
}
DEBUG(10,("map_canon_ace_perms: Mapped (UNIX) %x to (NT) %x\n",
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index acd84d6..23fa3e8 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -46,9 +46,9 @@ static NTSTATUS check_path_syntax_internal(char *path,
{
char *d = path;
const char *s = path;
- NTSTATUS ret = NT_STATUS_OK;
bool start_of_name_component = True;
bool stream_started = false;
+ bool check_quota = false;
*p_last_component_contains_wcard = False;
@@ -66,7 +66,7 @@ static NTSTATUS check_path_syntax_internal(char *path,
return NT_STATUS_OBJECT_NAME_INVALID;
}
if (StrCaseCmp(s, ":$DATA") != 0) {
- return NT_STATUS_INVALID_PARAMETER;
+ check_quota = true;
}
break;
}
@@ -127,8 +127,7 @@ static NTSTATUS check_path_syntax_internal(char *path,
/* Are we at the start ? Can't go back further if so. */
if (d <= path) {
- ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
- break;
+ return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
}
/* Go back one level... */
/* We know this is safe as '/' cannot be part of a mb sequence. */
@@ -201,7 +200,13 @@ static NTSTATUS check_path_syntax_internal(char *path,
*d = '\0';
- return ret;
+ if (check_quota) {
+ if (StrCaseCmp(path, FAKE_FILE_NAME_QUOTA_UNIX) != 0) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ }
+
+ return NT_STATUS_OK;
}
/****************************************************************************
diff --git a/source3/utils/net_rpc.c b/source3/utils/net_rpc.c
index 59dbf9f..75726b0 100644
--- a/source3/utils/net_rpc.c
+++ b/source3/utils/net_rpc.c
@@ -586,6 +586,12 @@ static NTSTATUS rpc_getsid_internals(struct net_context *c,
int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
{
+ int conn_flags = NET_FLAGS_PDC;
+
+ if (!c->opt_user_specified) {
+ conn_flags |= NET_FLAGS_ANONYMOUS;
+ }
+
if (c->display_usage) {
d_printf("Usage:\n"
"net rpc getsid\n"
@@ -594,7 +600,7 @@ int net_rpc_getsid(struct net_context *c, int argc, const char **argv)
}
return run_rpc_command(c, NULL, &ndr_table_samr.syntax_id,
- NET_FLAGS_ANONYMOUS | NET_FLAGS_PDC,
+ conn_flags,
rpc_getsid_internals,
argc, argv);
}
--
Samba Shared Repository
More information about the samba-cvs
mailing list