[SCM] Samba Shared Repository - branch v3-5-stable updated

Karolin Seeger kseeger at samba.org
Fri Oct 8 06:38:51 MDT 2010


The branch, v3-5-stable has been updated
       via  01a15b1 WHATASNEW: Start 3.5.7 release notes.
       via  c9622dd VERSION: Bump version number up to 3.5.7.
       via  7d36ff6 WHATSNEW: Update release notes.
       via  77ca7e2 s3: Stop using the write cache after an oplock break
       via  7d1db0a Fix bug 7694 - Crash bug with invalid SPNEGO token.
       via  6348973 WHATSNEW: Update release notes.
       via  b1f6379 Fix bug #7698 - Assert causes smbd to panic on invalid NetBIOS session request.
       via  afc0d4a s3: Fix bug 7470
       via  9fe3146 WHATSNEW: Update changes since 3.5.5.
       via  fef3e8b s3: Fix bug 7688, rpcclient command line completion crashing
       via  5764e04 s3: Remove a global variable in bugfix for bug 7665 (cherry picked from commit cf364274cbae996fbe186b2c2792b212f189e26a)
       via  72b1f4f s3-libnetapi: Fix Bug #7665, memory leak in netapi connection manager.
       via  31c319f s3: Fix the charset_pull routine
       via  df774be s3: fix build on platforms without st_blocks and st_blksize stat struct members
       via  44c7f7d Fix bug #7693 - smbd changing mode of files on rename
       via  2a284c4 s3:smbd: Align change notify replies on 4-byte boundary
       via  01ac9d5 libwbclient: Fix a fd-leak at dlclose-time
       via  48cbe7a s3-spoolss: add and use spoolss_printerinfo2_to_setprinterinfo2().
       via  f7718e0 s3-rpcclient: fix two more invalid typecasts in spoolss commands.
       via  6653e9c s3-net: fix a "dereferencing type-punned pointer will break strict-aliasing rules" warning.
       via  0212976 s3: Cache results of finding printer names
       via  c72fe31 Fix bug #7651 - mknod and mkfifo fails with "No such file or directory"
       via  99cb69f s3-dcerpc: avoid talloc_move on schannel creds in cli_rpc_pipe_open_schannel_with_key().
       via  1c1eb9a Final part of fix for bug #7636 - winbind internal error, backtrace.
       via  3bb92eb s3: fall back to cups-config for underlinked libs
       via  c97aa70 s3: Fix bug 7635
       via  b8f9c3c Fix bug #7589 - ntlm_auth fails to use cached credentials.
       via  deb10a5 Fix bug 7581 - Users in "admin users" in smb.conf file are unable to read/write all files when the acl_xattr vfs module is used.
       via  8f93503 s3-printing: fix BUG 7280 - auto printers not loading with registry config (cherry picked from commit bb92b0e1571e4766ab20bb3eea53f9e7f9567a5f)
       via  0a66309 Fix bug 7590 - offline login fails because winbind deletes cache on every startup.
       via  63a8bb8 rerun: make samba3-idl
       via  7e1964f pidl: Samba3/ClientNDR - Correctly copy arrays, if r.out.size < r.in.size.
       via  514fa59 Fix bug #7617 - smbd coredump due to uninitialized variables in the performance counter code.
       via  aefad86 s3-winbind: Fix Bug #7568: Make sure cm_connect_lsa_tcp does not reset the secure channel.
       via  0f90a35 s3: Fix bug 7578
       via  f5dbdef s3-libsmb: Fix bug #7577.
       via  872c43a s3-libsmb: Fix bug #7583.
       via  b369a7e librpc: split out a separate GUID_from_ndr_blob() function
       via  f72dbd0 s3: Fix bug 7336: Enable idmap_passdb module build as shared (cherry picked from commit 8c0fbc410798512b7a4b7db73bcb24cde6fa7849) (cherry picked from commit b4803af11525823ea508d0ca4e58402d55901194)
       via  2913db0 s3-printing: Fix Bug #7541, %D in "printer admin" causing smbd crash.
       via  41374f1 s3-librpc: Fixed GUID_from_data_blob() with length of 32.
      from  2ee3b08 VERSION: Bump version number up to 3.5.6.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-5-stable


- Log -----------------------------------------------------------------
commit 01a15b10d185fcb3be6ceaf29fd0b70a5b0c98fd
Author: Karolin Seeger <kseeger at samba.org>
Date:   Fri Oct 8 14:36:50 2010 +0200

    WHATASNEW: Start 3.5.7 release notes.
    
    Karolin
    (cherry picked from commit 34aa6f4b920fee5adf4376d7626efb4782ae039a)

commit c9622dd25fea4a5f11b33799d3897af6eff47183
Author: Karolin Seeger <kseeger at samba.org>
Date:   Fri Oct 8 14:35:23 2010 +0200

    VERSION: Bump version number up to 3.5.7.
    
    Karolin
    (cherry picked from commit 7e0ae1b5538da956d2d301cf0fe01f82f98fe024)

commit 7d36ff6e592292d3feaf532a2cbb5480b9faa94c
Author: Karolin Seeger <kseeger at samba.org>
Date:   Thu Oct 7 18:21:32 2010 +0200

    WHATSNEW: Update release notes.
    
    Karolin
    (cherry picked from commit 2c88eee4a311a9d62d121063051c0e3adf145000)

commit 77ca7e289e916ed627bb7b343b94a0ee5e078e87
Author: Volker Lendecke <vl at samba.org>
Date:   Sat Oct 2 17:07:00 2010 +0200

    s3: Stop using the write cache after an oplock break
    
    Fix bug #7715 (Setting Samba Write Cache Size Can Cause File Corruption).
    (cherry picked from commit 9f8292e5f765dff586bfbb261b54da4d4b27a837)

commit 7d1db0a35bd8e835147c5dce3bcb0444ccc12dd6
Author: Jeremy Allison <jra at samba.org>
Date:   Sun Sep 26 04:59:31 2010 -0700

    Fix bug 7694 - Crash bug with invalid SPNEGO token.
    
    Found by the CodeNomicon test suites at the SNIA plugfest.
    
    http://www.codenomicon.com/
    
    If an invalid SPNEGO packet contains no OIDs we crash in the SMB1/SMB2 server
    as we indirect the first returned value OIDs[0], which is returned as NULL.
    
    Modified for 3.5.x.
    
    Jeremy.
    (cherry picked from commit 5e7e402320ebce06957e85f35d478615b2210a87)

commit 63489730737e36580a98e7c5c6c94f11b615f5e4
Author: Karolin Seeger <kseeger at samba.org>
Date:   Wed Oct 6 21:24:30 2010 +0200

    WHATSNEW: Update release notes.
    
    Karolin
    (cherry picked from commit b19f866f2285da5ecc3982b2c9c0ccd005dd41cc)

commit b1f637924f3470346d01a3359743aa00ba48a63e
Author: Jeremy Allison <jra at samba.org>
Date:   Sun Sep 26 04:49:29 2010 -0700

    Fix bug #7698 - Assert causes smbd to panic on invalid NetBIOS session request.
    
    Found by the CodeNomicon test suites at the SNIA plugfest.
    
    http://www.codenomicon.com/
    
    If an invalid NetBIOS session request is received the code in name_len() in
    libsmb/nmblib.c can hit an assert.
    
    Re-write name_len() and name_extract() to use "buf/len" pairs and
    always limit reads.
    
    (Modified for 3.5.x)
    
    Jeremy.
    (cherry picked from commit 08bb0fb61580cf528109ebd061a91e4fa5be5a2b)

commit afc0d4a267da57c19b43d819e8166bfdc5cb3ec2
Author: Volker Lendecke <vl at samba.org>
Date:   Sat Sep 25 10:56:58 2010 -0700

    s3: Fix bug 7470
    
    S_IREAD and S_IWRITE are not standard.
    
    Thanks to Joachim Schmitz <schmitz at hp.com> for reporting!
    (cherry picked from commit f1f260c018bfb5b2269731bb806176da1db12db8)

commit 9fe314615e5a8303037d66c32db6d7a768e76be0
Author: Karolin Seeger <kseeger at samba.org>
Date:   Mon Sep 27 22:04:27 2010 +0200

    WHATSNEW: Update changes since 3.5.5.
    
    Karolin
    (cherry picked from commit ca69f9665441f51a59b215f466311dac5fc1bc88)

commit fef3e8be33525773f4ca2f03f55453783e2b4bb5
Author: Volker Lendecke <vl at samba.org>
Date:   Sat Sep 18 07:37:04 2010 -0700

    s3: Fix bug 7688, rpcclient command line completion crashing
    
    We've grown more than 100 rpcclient commands by now, so this would overwrite
    the array of 100 completions. There's nicer ways to fix this problem, but 1000
    rpcclient commands should be at least a bit away.
    (cherry picked from commit ec3bca61a10d8dcaa6a94046120dd414e39289b1)

commit 5764e042af1d62c158d850d5918162f576accc32
Author: Volker Lendecke <vl at samba.org>
Date:   Tue Sep 21 15:41:23 2010 -0700

    s3: Remove a global variable in bugfix for bug 7665
    (cherry picked from commit cf364274cbae996fbe186b2c2792b212f189e26a)

commit 72b1f4f4d3db0b84bb9b87e97fb3bfe97ecb7f11
Author: Günther Deschner <gd at samba.org>
Date:   Mon Sep 20 21:05:37 2010 -0700

    s3-libnetapi: Fix Bug #7665, memory leak in netapi connection manager.
    
    Guenther
    (cherry picked from commit 6f47a24bc55be0ea907594a748774675a105b5e3)
    (cherry picked from commit f9f54825238d4e30827dea897456ff8cf4e6730c)

commit 31c319f9366c92365dcf1e4f57897289b7ef2cfe
Author: Volker Lendecke <vl at samba.org>
Date:   Mon Sep 6 15:13:48 2010 +0200

    s3: Fix the charset_pull routine
    
    In the push routine we do the SVAL, so we should do the SSVAL here.
    
    Fix bug #7531 (3.5.3 unusable on solaris 10).
    (cherry picked from commit 73a7100a21a50873d09cef7a100ed75c4095863f)

commit df774be5b1a022562342f896d179639f2f5bd89c
Author: Björn Jacke <bj at sernet.de>
Date:   Mon Jun 7 23:06:28 2010 +0200

    s3: fix build on platforms without st_blocks and st_blksize stat struct members
    
    This fixes bug 7474.
    (cherry picked from commit 18516e062c9c4fc2a61a7ef7c8b173683c02e2e8)

commit 44c7f7da21fdc6fa13e16859767f63674b9ada2d
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Sep 22 12:26:13 2010 -0700

    Fix bug #7693 - smbd changing mode of files on rename
    
    When using "map archive", don't change the archive bit on
    renames or writes with UNIX extensions turned on.
    
    Jeremy.
    (cherry picked from commit 24f9210fe1e2280e08a7b2dd2cb33e7af4c1c002)

commit 2a284c42cd06a740cb1b15af0c3d77f667b7dad1
Author: Chere Zhou <chere.zhou at isilon.com>
Date:   Mon Jul 5 17:18:35 2010 -0700

    s3:smbd: Align change notify replies on 4-byte boundary
    
    MS-CIFS section 2.2.7.4.2 states this is mandatory.  WinXP clients
    don't seem to care, but a Win7 client will send an immediate Close()
    to the directory handle when receiving an incorrectly aligned
    change notify response.
    
    Fix bug #7662 (Change notify replies must be aligned on 4-byte boundary for
    Win7.)
    (cherry picked from commit 2ee2ea9fa5b839a4395895872f1ed149226dd06f)

commit 01ac9d54f0907c1b16402857e8672da8ebb7b294
Author: Volker Lendecke <vl at samba.org>
Date:   Mon May 10 12:05:01 2010 +0200

    libwbclient: Fix a fd-leak at dlclose-time
    
    __attribute__((destructor)) makes winbind_close_sock() being called at
    dlclose() time.
    
    Found while testing apache on Linux with mod_auth_pam.
    
    Other platforms will have to find a different fix. One possibility would be to
    always close the socket after each operation, but this badly sucks
    performance-wise.
    
    Fix bug #7684 (fd leak in libwbclient.so).
    (cherry picked from commit f7e7fa50ec3aef60b72a34988825e314b7228c23)

commit 48cbe7a7b024c82c6cc0bcc4621b0867d08083b1
Author: Günther Deschner <gd at samba.org>
Date:   Thu Jun 3 16:30:55 2010 +0200

    s3-spoolss: add and use spoolss_printerinfo2_to_setprinterinfo2().
    
    This fixes some invalid typecasts.
    
    Guenther
    
    The last 3 patches address bug #7658 (fix some "dereferencing type-punned
    pointer will break strict-aliasing rules" warnings).
    (cherry picked from commit 1a4a8e9bfb146276174a3723e3f20897e0443542)

commit f7718e0293b3daff1ebae687fa194f49e6aca133
Author: Günther Deschner <gd at samba.org>
Date:   Mon May 10 14:44:30 2010 +0200

    s3-rpcclient: fix two more invalid typecasts in spoolss commands.
    
    Guenther
    (cherry picked from commit 83736066a3f94eaadb422016c9f22cb18bec2cd7)
    (cherry picked from commit 589bb48af5708501ab47335c84a59f0923ccb20b)

commit 6653e9cf5a738b7a3cc46072edc7aeb0d562d5fe
Author: Günther Deschner <gd at samba.org>
Date:   Tue May 25 12:43:00 2010 +0200

    s3-net: fix a "dereferencing type-punned pointer will break strict-aliasing rules" warning.
    
    Guenther
    (cherry picked from commit f12028a3fd5c64bc8e13996cb9a18a19ec0929e0)
    (cherry picked from commit a88f1bddbc348075c322834153040b57f5eb6ab0)

commit 0212976791b5f3e547e840db9d44edba63e96c89
Author: Volker Lendecke <vl at samba.org>
Date:   Fri Aug 27 14:44:16 2010 +0200

    s3: Cache results of finding printer names
    
    With hundreds of printers or on a slow machine, this can become expensive.
    
    Problem reported and patch sponsored by DESY, Hamburg (www.desy.de)
    
    Fix bug #7656 (Scalability problem with hundreds of printers).
    (cherry picked from commit de445e29ce944985651cbd62c8203cc9ace51a25)

commit c72fe31a4c25eb9d43893ab4d53db50288765eea
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Aug 26 16:49:21 2010 -0700

    Fix bug #7651 - mknod and mkfifo fails with "No such file or directory"
    
    Ensure we check the correct stat struct once we've created the
    special fix. Thanks to izh1979 at gmail.com for pointing out the
    bug.
    
    Jeremy.
    (cherry picked from commit 3ced147b6e0ba872b6b49a27f30e4a44695d42f3)

commit 99cb69fca3d8374df3a85ec76180fc4e6acb15f8
Author: Günther Deschner <gd at samba.org>
Date:   Mon Aug 23 16:02:23 2010 +0200

    s3-dcerpc: avoid talloc_move on schannel creds in cli_rpc_pipe_open_schannel_with_key().
    
    Initially, the schannel creds were talloc memduped, then, during the netlogon
    creds client merge (baf7274fed2f1ae7a9e3a57160bf5471566e636c) they were first
    talloc_referenced and then later (53765c81f726a8c056cc4e57004592dd489975c9)
    talloc_moved.
    
    The issue with using talloc_move here is that users of that function in winbind
    will only be able to have two schanneled connections, as the cached schannel
    credentials pointer from the netlogon pipe will be set to NULL. Do a deep copy
    of the struct instead.
    
    Guenther
    (cherry picked from commit 898c6123355a3a11ec17f0396c4cb3018c75c184)
    (cherry picked from commit 68e83f9fedf0a0f0fa412d3ecec8ee853bf82bac)

commit 1c1eb9a2bb622a041891c65abc62e72b7782d77f
Author: Jeremy Allison <jra at samba.org>
Date:   Mon Aug 23 13:05:56 2010 -0700

    Final part of fix for bug #7636 - winbind internal error, backtrace.
    
    Ensure cm_get_schannel_creds() returns NTSTATUS.
    
    Jeremy.
    (cherry picked from commit 33060f67be100836d381a74bced351c6579cc58d)
    (cherry picked from commit ab96b398a5afc7e877cffd9d7c749a72916c6b5c)

commit 3bb92eb3b49c37e223cfc9734abd8432cd90b0db
Author: Björn Jacke <bj at sernet.de>
Date:   Thu Aug 12 16:18:45 2010 +0200

    s3: fall back to cups-config for underlinked libs
    
    some OpenBSD systems have underlinked cups libraries. If linking against cups
    alone fails, try to link against all the cups-config --libs cruft, which we
    usually don't want. (bugzila #7244)
    (cherry picked from commit 616e187d68e3e7b202413a96518b31d029e9563a)
    (cherry picked from commit fd43cc698a7f03c4d6c48d21e88097cc5050ca8e)

commit c97aa707bb8aa070727d4b880b66ee72ed5d4f7f
Author: Volker Lendecke <vl at samba.org>
Date:   Sat Aug 21 11:32:58 2010 +0200

    s3: Fix bug 7635
    
    smbclient -M not sending due to NT_STATUS_PIPE_BROKEN
    (cherry picked from commit fe4dcd44ec581afb631125b1d0bade055ca97e30)

commit b8f9c3c9bb89f8be61452d530b2b8d3c1debe9bc
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Jul 29 13:44:35 2010 -0700

    Fix bug #7589 - ntlm_auth fails to use cached credentials.
    
    In handling the WINBINDD_PAM_AUTH message winbindd canonicalizes a *copy*
    of the mapped username, but fails to canonicalize the actual username
    sent to the backend domain process. When "winbind default domain"
    is set this can lead to credentials being cached with an index of
    user: user, not DOMAIN\user. All other code paths that use
    canonicalize_username() (WINBINDD_PAM_CHAUTHTOK, WINBINDD_PAM_LOGOFF)
    correctly canonicalize the data sent to the backend. All calls
    the can cause credentials to be looked up (PAM_CHAUTHTOK etc.)
    correctly call canonicalize_username() to create the credential
    lookup key.
    
    Jeremy.
    (cherry picked from commit c3f2015075ff1e523536cdd242ba0ec5b26f081c)

commit deb10a581c78bd1ad44059766478ffa920a853c6
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Aug 12 17:02:30 2010 -0700

    Fix bug 7581 - Users in "admin users" in smb.conf file are unable to read/write all files when the acl_xattr vfs module is used.
    
    Correctly check admin users in smb1_file_se_access_check().
    
    Jeremy.
    (cherry picked from commit 383477789445d42d0d7451fea770c456625f16e1)

commit 8f935033f2d679331d6f9a86f7f0474964ac28b1
Author: Jim McDonough <jmcd at samba.org>
Date:   Mon Aug 23 11:13:06 2010 +0200

    s3-printing: fix BUG 7280 - auto printers not loading with registry config
    (cherry picked from commit bb92b0e1571e4766ab20bb3eea53f9e7f9567a5f)

commit 0a66309682d66b8f2a10f0980fb5e73a6c6a601a
Author: Jeremy Allison <jra at samba.org>
Date:   Tue Jul 27 01:54:01 2010 -0700

    Fix bug 7590 - offline login fails because winbind deletes cache on every startup.
    
    Sync lib/tdb_validate.c with the change in current master.
    Change tdb_validate_open() to always use O_RDWR instead of O_RDONLY,
    as (from the bug report): "db_check() will always return failure for a read-only database.
    Silently, without any log output, when _tdb_lockall() fails."
    
    Jeremy.
    (cherry picked from commit 39cb903463d8a3fcabd9e148112bf5cf81744130)

commit 63a8bb89c0d0183c09ab7a1de046abe0f670dd55
Author: Stefan Metzmacher <metze at samba.org>
Date:   Mon Aug 9 11:26:59 2010 +0200

    rerun: make samba3-idl
    
    metze
    (cherry picked from commit 5dff580fb710c9fe95a77afdb543203c4a6e5645)

commit 7e1964f1d6e194662fef0c8ad0220528e7a9e6e0
Author: Stefan Metzmacher <metze at samba.org>
Date:   Thu Aug 5 10:04:57 2010 +0200

    pidl: Samba3/ClientNDR - Correctly copy arrays, if r.out.size < r.in.size.
    
    metze
    
    Signed-off-by: Andreas Schneider <asn at samba.org>
    (cherry picked from commit 33d1879d5b50e2d98c1bb13b835e7cfb178e3336)
    (cherry picked from commit d1e92cd2944983ecabd0511ff7c8221c1033a3a8)
    Fixes bug #7607.
    (cherry picked from commit 614e9504a98a3a484a14c89b814952aeddc43dac)

commit 514fa59e53da7b106d58e2dbb85c4304036be622
Author: Jeremy Allison <jra at samba.org>
Date:   Thu Aug 12 14:24:01 2010 -0700

    Fix bug #7617 - smbd coredump due to uninitialized variables in the performance counter code.
    
    In the file rpc_server.c, function _winreg_QueryValue()
    
    uint8_t *outbuf
    
    Should be :
    
    uint8_t *outbuf = NULL;
    
    As it is later freed by
    
          if (free_buf) SAFE_FREE(outbuf);
    
    in some cases, this frees the unintialized outbuf, which causes a coredump.
    (cherry picked from commit 84fd910c347ddfad6f01edbe7f6e25546c8382ee)
    (cherry picked from commit 80e65236158d6f1690bf9f153c0eb12d81d56b8a)

commit aefad86f512c035d75190031f31eca30df2b4736
Author: Günther Deschner <gd at samba.org>
Date:   Mon Aug 9 14:31:24 2010 +0200

    s3-winbind: Fix Bug #7568: Make sure cm_connect_lsa_tcp does not reset the secure channel.
    
    This is an important fix as the following could and is happening:
    
    * winbind authenticates a user via schannel secured netlogon samlogonex call,
    current secure channel cred state is stored in winbind state, winbind
    sucessfully decrypts session key from the info3
    
    * winbind sets up a new schannel ncacn_ip_tcp lsa pipe (and thereby resets the
    secure channel on the dc)
    
    * subsequent samlogonex calls use the new secure channel creds on the dc to
    encrypt info3 session key, while winbind tries to use old schannel creds for
    decryption
    
    Guenther
    (cherry picked from commit be396411a4e1f3a174f8a44b6c062d834135e70a)
    (cherry picked from commit afe0e73b7bb640428396c9f40dbbcba5c311fcd9)
    (cherry picked from commit 179399401ccae7ae2579b94420d0386531ad2686)

commit 0f90a359b68faa93d07c4115d2a5f8494f330ba6
Author: Jeremy Allison <jra at samba.org>
Date:   Tue Jul 27 10:05:16 2010 +0200

    s3: Fix bug 7578
    
    'net idmap restore' fails to set HWM, causing duplicates
    (cherry picked from commit de7cb260e2145674bd5428c3e08b885fb0450659)

commit f5dbdef78af9777fde64a6cfaa052613b987276d
Author: Jeremy Allison <jra at samba.org>
Date:   Tue Jul 27 08:45:46 2010 +0200

    s3-libsmb: Fix bug #7577.
    
    SPNEGO auth fails when contacting Win7 system using Microsoft Live Sign-in
    Assistant.
    (cherry picked from commit 97e0238d0e8b1573a408648bff29958a2e1a89e8)

commit 872c43af30469e1235b80dafb84cfbddcf6074b1
Author: Jeremy Allison <jra at samba.org>
Date:   Tue Jul 27 08:40:58 2010 +0200

    s3-libsmb: Fix bug #7583.
    
    Smbclient fails to kerberos connect to a Alfresco JLAN
    CIFS Server.
    (cherry picked from commit 3b3670e329f1e0e5f76adfbdbbcadd9ee0202328)

commit b369a7e82138fde7b8c78aab72fa912e1acc0f2a
Author: Andrew Tridgell <tridge at samba.org>
Date:   Thu Dec 10 11:22:20 2009 +1100

    librpc: split out a separate GUID_from_ndr_blob() function
    
    This will simplify many of the places that deal with NDR formatted
    GUIDs
    (cherry picked from commit effff544265c63c95cf630d426b630bfe4d25aec)
    
    This patch is part of a fix for bug #7538 (Backport fixes for
    GUID_from_data_blob).
    (cherry picked from commit e8ed2b596627e8704e3384d5997020059b47144a)

commit f72dbd0f4cf343895e484d6ee11b90965b9f29ac
Author: Volker Lendecke <vl at samba.org>
Date:   Sun Jul 4 10:01:42 2010 +0200

    s3: Fix bug 7336: Enable idmap_passdb module build as shared
    (cherry picked from commit 8c0fbc410798512b7a4b7db73bcb24cde6fa7849)
    (cherry picked from commit b4803af11525823ea508d0ca4e58402d55901194)

commit 2913db00ca3da87643cb8fcc0b0884bddc65d4e8
Author: Günther Deschner <gd at samba.org>
Date:   Thu Jul 1 13:58:56 2010 +0200

    s3-printing: Fix Bug #7541, %D in "printer admin" causing smbd crash.
    
    Guenther
    (cherry picked from commit f3c852eb5f771fc8a48aa674d39e1a4547e2eb3e)

commit 41374f171e3648614c7d61f149ed550f400f4218
Author: Andreas Schneider <asn at samba.org>
Date:   Mon Jun 28 21:00:30 2010 +0200

    s3-librpc: Fixed GUID_from_data_blob() with length of 32.
    
    If we hit the case that the blob length is 32. The code goes to the end
    of the function and generates a GUID with garbage.
    So try to convert the blob to the GUID and return.
    
    Fix bug #7538 (Backport fixes for GUID_from_data_blob).
    (cherry picked from commit 3c4353d2aa15db278bb87c949cce2deb3a5072ca)

-----------------------------------------------------------------------

Summary of changes:
 WHATSNEW.txt                            |  104 +++++++++++-
 lib/util/charset/charset.h              |    2 +-
 libcli/auth/credentials.c               |   46 +++++-
 libcli/auth/proto.h                     |    2 +
 librpc/gen_ndr/cli_epmapper.c           |   22 ++-
 librpc/gen_ndr/cli_ntsvcs.c             |   22 ++-
 librpc/gen_ndr/cli_winreg.c             |   47 ++++-
 librpc/ndr/libndr.h                     |    1 +
 librpc/ndr/uuid.c                       |   44 +++--
 nsswitch/wb_common.c                    |    3 +
 pidl/lib/Parse/Pidl/Samba3/ClientNDR.pm |   56 +++++-
 source3/Makefile.in                     |    4 +
 source3/VERSION                         |    2 +-
 source3/configure.in                    |   14 +-
 source3/include/proto.h                 |   11 +-
 source3/lib/netapi/cm.c                 |   98 +++++++---
 source3/lib/netapi/netapi_private.h     |    1 +
 source3/lib/system.c                    |    9 +
 source3/lib/tdb_validate.c              |    2 +-
 source3/libads/sasl.c                   |    3 +-
 source3/libsmb/cliconnect.c             |   18 ++-
 source3/libsmb/clikrb5.c                |  303 +++++++++++++++----------------
 source3/libsmb/climessage.c             |    6 +-
 source3/libsmb/clispnego.c              |   47 +++++-
 source3/libsmb/nmblib.c                 |   86 ++++++---
 source3/modules/vfs_acl_common.c        |    6 +-
 source3/printing/load.c                 |    4 +
 source3/printing/nt_printing.c          |    4 +-
 source3/registry/reg_api.c              |    2 +-
 source3/rpc_client/cli_pipe.c           |   10 +-
 source3/rpc_client/init_spoolss.c       |   29 +++
 source3/rpc_server/srv_pipe.c           |    3 +-
 source3/rpc_server/srv_spoolss_nt.c     |   61 ++++++-
 source3/rpc_server/srv_winreg_nt.c      |    4 +-
 source3/rpcclient/cmd_spoolss.c         |   41 +---
 source3/rpcclient/rpcclient.c           |    2 +-
 source3/smbd/fileio.c                   |   13 +-
 source3/smbd/notify.c                   |   10 +
 source3/smbd/open.c                     |   31 ++--
 source3/smbd/oplock.c                   |    1 +
 source3/smbd/process.c                  |    2 +-
 source3/smbd/reply.c                    |   44 ++++--
 source3/smbd/sesssetup.c                |    3 +-
 source3/smbd/trans2.c                   |    4 +-
 source3/utils/net_ads.c                 |    4 +-
 source3/utils/net_rpc_printer.c         |   11 +-
 source3/utils/net_rpc_registry.c        |    3 +-
 source3/utils/profiles.c                |    3 +-
 source3/utils/smbfilter.c               |   41 ++++-
 source3/winbindd/winbindd_cm.c          |   47 +++--
 source3/winbindd/winbindd_dual_srv.c    |    4 +-
 source3/winbindd/winbindd_pam.c         |   16 +-
 52 files changed, 949 insertions(+), 407 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 4fea69b..a9edeb1 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,46 @@
                    =============================
+                   Release Notes for Samba 3.5.7
+			  , 2010
+                   =============================
+
+
+This is the latest stable release of Samba 3.5.
+
+Major enhancements in Samba 3.5.7 include:
+
+  o
+
+Changes since 3.5.5
+-------------------
+
+
+o   Jeremy Allison <jra at samba.org>
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 3.5 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+                   =============================
                    Release Notes for Samba 3.5.6
 			  October 8, 2010
                    =============================
@@ -8,12 +50,70 @@ This is the latest stable release of Samba 3.5.
 
 Major enhancements in Samba 3.5.6 include:
 
+  o Fix smbd panic on invalid NetBIOS session request (bug #7698).
+  o Fix smbd crash caused by "%D" in "printer admin" (bug #7541).
+  o Fix crash bug with invalid SPNEGO token (bug #7694).
+  o Fix Winbind internal error (bug #7636).
+
 
 Changes since 3.5.5
 -------------------
 
 
 o   Jeremy Allison <jra at samba.org>
+    * BUG 7577: Fix SPNEGO auth when contacting Win7 system using Microsoft Live
+      Sign-in Assistant.
+    * BUG 7578: Fix 'net idmap restore' setting HWM to avoid duplicates.
+    * BUG 7581: Fix "admin users" when using vfs_acl_xattr.
+    * BUG 7583: Fix smbclient to connect to Alfresco JLAN CIFS server using
+      Kerberos.
+    * BUG 7589: Fix using cached credentials in ntlm_auth.
+    * BUG 7590: Fix Winbind offline login.
+    * BUG 7617: Fix smbd coredump due to uninitialized variables in the
+      performance counter code.
+    * BUG 7636: Fix Winbind internal error.
+    * BUG 7651: Fix mknod and mkfifo failing with "No such file or
+      directory".
+    * BUG 7693: Fix smbd changing mode of files on rename.
+    * BUG 7694: Fix crash bug with invalid SPNEGO token.
+    * BUG 7698: Fix smbd panic on invalid NetBIOS session request.
+
+
+o   Günther Deschner <gd at samba.org>
+    * BUG 7541: Fix smbd crash caused by "%D" in "printer admin".
+    * BUG 7568: Make sure cm_connect_lsa_tcp does not reset the secure channel.
+    * BUG 7658: Fix "dereferencing type-punned pointer will break
+      strict-aliasing rules" warnings).
+    * BUG 7665: Fix memory leak in netapi connection manager.
+
+
+o   Björn Jacke <bj at sernet.de>
+    * BUG 7244: Fall back to cups-config for underlinked libs.
+    * BUG 7474: Fix build on platforms without st_blocks and st_blksize stat
+      struct members.
+
+
+o   Volker Lendecke <vl at samba.org>
+    * BUG 7336: Enable idmap_passdb module build as shared.
+    * BUG 7531: Fix the charset_pull routine.
+    * BUG 7635: Fix 'smbclient -M'.
+    * BUG 7656: Fix scalability problem with hundreds of printers.
+    * BUG 7684: Fix fd leak in libwbclient.so.
+    * BUG 7688: Fix crash bug in rpcclient.
+    * BUG 7470: Standardize S_IREAD and S_IWRITE.
+    * BUG 7715: Fix file corruption when setting Samba "write wache wize".
+
+
+o   Jim McDonough <jmcd at samba.org>
+    * BUG 7280: Fix auto printers with registry config.
+
+
+o   Andreas Schneider <asn at samba.org>
+    * BUG 7538: Fix GUID_from_data_blob() with length of 32.
+
+
+o   Chere Zhou <chere.zhou at isilon.com>
+    * BUG 7662: Align change notify replies on 4-byte boundary.
 
 
 ######################################################################
@@ -36,8 +136,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    =============================
                    Release Notes for Samba 3.5.5
diff --git a/lib/util/charset/charset.h b/lib/util/charset/charset.h
index 2c8aa41..c9425ef 100644
--- a/lib/util/charset/charset.h
+++ b/lib/util/charset/charset.h
@@ -242,7 +242,7 @@ static size_t CHARSETNAME ## _pull(void *cd, const char **inbuf, size_t *inbytes
 			 char **outbuf, size_t *outbytesleft)					\
 {												\
 	while (*inbytesleft >= 1 && *outbytesleft >= 2) {					\
-		*(uint16*)(*outbuf) = to_ucs2[((unsigned char*)(*inbuf))[0]];			\
+		SSVAL(*outbuf, 0, to_ucs2[((unsigned char*)(*inbuf))[0]]);			\
 		(*inbytesleft)  -= 1;								\
 		(*outbytesleft) -= 2;								\
 		(*inbuf)  += 1;									\
diff --git a/libcli/auth/credentials.c b/libcli/auth/credentials.c
index 87d1866..504f594 100644
--- a/libcli/auth/credentials.c
+++ b/libcli/auth/credentials.c
@@ -24,6 +24,7 @@
 #include "system/time.h"
 #include "../lib/crypto/crypto.h"
 #include "libcli/auth/libcli_auth.h"
+#include "../libcli/security/dom_sid.h"
 
 static void netlogon_creds_step_crypt(struct netlogon_creds_CredentialState *creds,
 				      const struct netr_Credential *in,
@@ -202,7 +203,7 @@ struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *me
 								  struct netr_Credential *initial_credential,
 								  uint32_t negotiate_flags)
 {
-	struct netlogon_creds_CredentialState *creds = talloc(mem_ctx, struct netlogon_creds_CredentialState);
+	struct netlogon_creds_CredentialState *creds = talloc_zero(mem_ctx, struct netlogon_creds_CredentialState);
 	
 	if (!creds) {
 		return NULL;
@@ -453,3 +454,46 @@ void netlogon_creds_decrypt_samlogon(struct netlogon_creds_CredentialState *cred
 	}
 }	
 
+/*
+  copy a netlogon_creds_CredentialState struct
+*/
+
+struct netlogon_creds_CredentialState *netlogon_creds_copy(TALLOC_CTX *mem_ctx,
+							   struct netlogon_creds_CredentialState *creds_in)
+{
+	struct netlogon_creds_CredentialState *creds = talloc_zero(mem_ctx, struct netlogon_creds_CredentialState);
+
+	if (!creds) {
+		return NULL;
+	}
+
+	creds->sequence			= creds_in->sequence;
+	creds->negotiate_flags		= creds_in->negotiate_flags;
+	creds->secure_channel_type	= creds_in->secure_channel_type;
+
+	creds->computer_name = talloc_strdup(creds, creds_in->computer_name);
+	if (!creds->computer_name) {
+		talloc_free(creds);
+		return NULL;
+	}
+	creds->account_name = talloc_strdup(creds, creds_in->account_name);
+	if (!creds->account_name) {
+		talloc_free(creds);
+		return NULL;
+	}
+
+	if (creds_in->sid) {
+		creds->sid = dom_sid_dup(creds, creds_in->sid);
+		if (!creds->sid) {
+			talloc_free(creds);
+			return NULL;
+		}
+	}
+
+	memcpy(creds->session_key, creds_in->session_key, sizeof(creds->session_key));
+	memcpy(creds->seed.data, creds_in->seed.data, sizeof(creds->seed.data));
+	memcpy(creds->client.data, creds_in->client.data, sizeof(creds->client.data));
+	memcpy(creds->server.data, creds_in->server.data, sizeof(creds->server.data));
+
+	return creds;
+}
diff --git a/libcli/auth/proto.h b/libcli/auth/proto.h
index e09cdee..c3878f5 100644
--- a/libcli/auth/proto.h
+++ b/libcli/auth/proto.h
@@ -35,6 +35,8 @@ void netlogon_creds_client_authenticator(struct netlogon_creds_CredentialState *
 				struct netr_Authenticator *next);
 bool netlogon_creds_client_check(struct netlogon_creds_CredentialState *creds,
 			const struct netr_Credential *received_credentials);
+struct netlogon_creds_CredentialState *netlogon_creds_copy(TALLOC_CTX *mem_ctx,
+							   struct netlogon_creds_CredentialState *creds_in);
 
 /*****************************************************************
 The above functions are common to the client and server interface
diff --git a/librpc/gen_ndr/cli_epmapper.c b/librpc/gen_ndr/cli_epmapper.c
index c83dba6..fcfefbc 100644
--- a/librpc/gen_ndr/cli_epmapper.c
+++ b/librpc/gen_ndr/cli_epmapper.c
@@ -380,7 +380,11 @@ static void rpccli_epm_Lookup_done(struct tevent_req *subreq)
 	/* Copy out parameters */
 	*state->orig.out.entry_handle = *state->tmp.out.entry_handle;
 	*state->orig.out.num_ents = *state->tmp.out.num_ents;
-	memcpy(state->orig.out.entries, state->tmp.out.entries, (state->tmp.in.max_ents) * sizeof(*state->orig.out.entries));
+	if ((*state->tmp.out.num_ents) > (state->tmp.in.max_ents)) {
+		tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+		return;
+	}
+	memcpy(state->orig.out.entries, state->tmp.out.entries, (*state->tmp.out.num_ents) * sizeof(*state->orig.out.entries));
 
 	/* Copy result */
 	state->orig.out.result = state->tmp.out.result;
@@ -453,7 +457,10 @@ NTSTATUS rpccli_epm_Lookup(struct rpc_pipe_client *cli,
 	/* Return variables */
 	*entry_handle = *r.out.entry_handle;
 	*num_ents = *r.out.num_ents;
-	memcpy(entries, r.out.entries, (r.in.max_ents) * sizeof(*entries));
+	if ((*r.out.num_ents) > (r.in.max_ents)) {
+		return NT_STATUS_INVALID_NETWORK_RESPONSE;
+	}
+	memcpy(entries, r.out.entries, (*r.out.num_ents) * sizeof(*entries));
 
 	/* Return result */
 	return NT_STATUS_OK;
@@ -549,7 +556,11 @@ static void rpccli_epm_Map_done(struct tevent_req *subreq)
 	/* Copy out parameters */
 	*state->orig.out.entry_handle = *state->tmp.out.entry_handle;
 	*state->orig.out.num_towers = *state->tmp.out.num_towers;
-	memcpy(state->orig.out.towers, state->tmp.out.towers, (state->tmp.in.max_towers) * sizeof(*state->orig.out.towers));
+	if ((*state->tmp.out.num_towers) > (state->tmp.in.max_towers)) {
+		tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+		return;
+	}
+	memcpy(state->orig.out.towers, state->tmp.out.towers, (*state->tmp.out.num_towers) * sizeof(*state->orig.out.towers));
 
 	/* Copy result */
 	state->orig.out.result = state->tmp.out.result;
@@ -618,7 +629,10 @@ NTSTATUS rpccli_epm_Map(struct rpc_pipe_client *cli,
 	/* Return variables */
 	*entry_handle = *r.out.entry_handle;
 	*num_towers = *r.out.num_towers;
-	memcpy(towers, r.out.towers, (r.in.max_towers) * sizeof(*towers));
+	if ((*r.out.num_towers) > (r.in.max_towers)) {
+		return NT_STATUS_INVALID_NETWORK_RESPONSE;
+	}
+	memcpy(towers, r.out.towers, (*r.out.num_towers) * sizeof(*towers));
 
 	/* Return result */
 	return NT_STATUS_OK;
diff --git a/librpc/gen_ndr/cli_ntsvcs.c b/librpc/gen_ndr/cli_ntsvcs.c
index 760ce53..e3e941a 100644
--- a/librpc/gen_ndr/cli_ntsvcs.c
+++ b/librpc/gen_ndr/cli_ntsvcs.c
@@ -1459,7 +1459,11 @@ static void rpccli_PNP_GetDeviceList_done(struct tevent_req *subreq)
 	}
 
 	/* Copy out parameters */
-	memcpy(state->orig.out.buffer, state->tmp.out.buffer, (*state->tmp.in.length) * sizeof(*state->orig.out.buffer));
+	if ((*state->tmp.out.length) > (*state->tmp.in.length)) {
+		tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+		return;
+	}
+	memcpy(state->orig.out.buffer, state->tmp.out.buffer, (*state->tmp.out.length) * sizeof(*state->orig.out.buffer));
 	*state->orig.out.length = *state->tmp.out.length;
 
 	/* Copy result */
@@ -1525,7 +1529,10 @@ NTSTATUS rpccli_PNP_GetDeviceList(struct rpc_pipe_client *cli,
 	}
 
 	/* Return variables */
-	memcpy(buffer, r.out.buffer, (*r.in.length) * sizeof(*buffer));
+	if ((*r.out.length) > (*r.in.length)) {
+		return NT_STATUS_INVALID_NETWORK_RESPONSE;
+	}
+	memcpy(buffer, r.out.buffer, (*r.out.length) * sizeof(*buffer));
 	*length = *r.out.length;
 
 	/* Return result */
@@ -1918,7 +1925,11 @@ static void rpccli_PNP_GetDeviceRegProp_done(struct tevent_req *subreq)
 
 	/* Copy out parameters */
 	*state->orig.out.reg_data_type = *state->tmp.out.reg_data_type;
-	memcpy(state->orig.out.buffer, state->tmp.out.buffer, (*state->tmp.in.buffer_size) * sizeof(*state->orig.out.buffer));
+	if ((*state->tmp.out.buffer_size) > (*state->tmp.in.buffer_size)) {
+		tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+		return;
+	}
+	memcpy(state->orig.out.buffer, state->tmp.out.buffer, (*state->tmp.out.buffer_size) * sizeof(*state->orig.out.buffer));
 	*state->orig.out.buffer_size = *state->tmp.out.buffer_size;
 	*state->orig.out.needed = *state->tmp.out.needed;
 
@@ -1992,7 +2003,10 @@ NTSTATUS rpccli_PNP_GetDeviceRegProp(struct rpc_pipe_client *cli,
 
 	/* Return variables */
 	*reg_data_type = *r.out.reg_data_type;
-	memcpy(buffer, r.out.buffer, (*r.in.buffer_size) * sizeof(*buffer));
+	if ((*r.out.buffer_size) > (*r.in.buffer_size)) {
+		return NT_STATUS_INVALID_NETWORK_RESPONSE;
+	}
+	memcpy(buffer, r.out.buffer, (*r.out.buffer_size) * sizeof(*buffer));
 	*buffer_size = *r.out.buffer_size;
 	*needed = *r.out.needed;
 
diff --git a/librpc/gen_ndr/cli_winreg.c b/librpc/gen_ndr/cli_winreg.c
index 1c37f51..15017d2 100644
--- a/librpc/gen_ndr/cli_winreg.c
+++ b/librpc/gen_ndr/cli_winreg.c
@@ -1668,7 +1668,15 @@ static void rpccli_winreg_EnumValue_done(struct tevent_req *subreq)
 		*state->orig.out.type = *state->tmp.out.type;
 	}
 	if (state->orig.out.value && state->tmp.out.value) {
-		memcpy(state->orig.out.value, state->tmp.out.value, (*state->tmp.in.size) * sizeof(*state->orig.out.value));
+		if ((*state->tmp.out.size) > (*state->tmp.in.size)) {
+			tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+			return;
+		}
+		if ((*state->tmp.out.length) > (*state->tmp.out.size)) {
+			tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+			return;
+		}
+		memcpy(state->orig.out.value, state->tmp.out.value, (*state->tmp.out.length) * sizeof(*state->orig.out.value));
 	}
 	if (state->orig.out.size && state->tmp.out.size) {
 		*state->orig.out.size = *state->tmp.out.size;
@@ -1752,7 +1760,13 @@ NTSTATUS rpccli_winreg_EnumValue(struct rpc_pipe_client *cli,
 		*type = *r.out.type;
 	}
 	if (value && r.out.value) {
-		memcpy(value, r.out.value, (*r.in.size) * sizeof(*value));
+		if ((*r.out.size) > (*r.in.size)) {
+			return NT_STATUS_INVALID_NETWORK_RESPONSE;
+		}
+		if ((*r.out.length) > (*r.out.size)) {
+			return NT_STATUS_INVALID_NETWORK_RESPONSE;
+		}
+		memcpy(value, r.out.value, (*r.out.length) * sizeof(*value));
 	}
 	if (size && r.out.size) {
 		*size = *r.out.size;
@@ -2823,7 +2837,15 @@ static void rpccli_winreg_QueryValue_done(struct tevent_req *subreq)
 		*state->orig.out.type = *state->tmp.out.type;
 	}
 	if (state->orig.out.data && state->tmp.out.data) {
-		memcpy(state->orig.out.data, state->tmp.out.data, (state->tmp.in.data_size?*state->tmp.in.data_size:0) * sizeof(*state->orig.out.data));
+		if ((state->tmp.out.data_size?*state->tmp.out.data_size:0) > (state->tmp.in.data_size?*state->tmp.in.data_size:0)) {
+			tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+			return;
+		}
+		if ((state->tmp.out.data_length?*state->tmp.out.data_length:0) > (state->tmp.out.data_size?*state->tmp.out.data_size:0)) {
+			tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+			return;
+		}
+		memcpy(state->orig.out.data, state->tmp.out.data, (state->tmp.out.data_length?*state->tmp.out.data_length:0) * sizeof(*state->orig.out.data));
 	}
 	if (state->orig.out.data_size && state->tmp.out.data_size) {
 		*state->orig.out.data_size = *state->tmp.out.data_size;
@@ -2904,7 +2926,13 @@ NTSTATUS rpccli_winreg_QueryValue(struct rpc_pipe_client *cli,
 		*type = *r.out.type;
 	}
 	if (data && r.out.data) {
-		memcpy(data, r.out.data, (r.in.data_size?*r.in.data_size:0) * sizeof(*data));
+		if ((r.out.data_size?*r.out.data_size:0) > (r.in.data_size?*r.in.data_size:0)) {
+			return NT_STATUS_INVALID_NETWORK_RESPONSE;
+		}
+		if ((r.out.data_length?*r.out.data_length:0) > (r.out.data_size?*r.out.data_size:0)) {
+			return NT_STATUS_INVALID_NETWORK_RESPONSE;
+		}
+		memcpy(data, r.out.data, (r.out.data_length?*r.out.data_length:0) * sizeof(*data));
 	}
 	if (data_size && r.out.data_size) {
 		*data_size = *r.out.data_size;
@@ -4629,7 +4657,11 @@ static void rpccli_winreg_QueryMultipleValues_done(struct tevent_req *subreq)
 	/* Copy out parameters */
 	memcpy(state->orig.out.values, state->tmp.out.values, (state->tmp.in.num_values) * sizeof(*state->orig.out.values));
 	if (state->orig.out.buffer && state->tmp.out.buffer) {
-		memcpy(state->orig.out.buffer, state->tmp.out.buffer, (*state->tmp.in.buffer_size) * sizeof(*state->orig.out.buffer));
+		if ((*state->tmp.out.buffer_size) > (*state->tmp.in.buffer_size)) {
+			tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+			return;
+		}
+		memcpy(state->orig.out.buffer, state->tmp.out.buffer, (*state->tmp.out.buffer_size) * sizeof(*state->orig.out.buffer));
 	}
 	*state->orig.out.buffer_size = *state->tmp.out.buffer_size;
 
@@ -4701,7 +4733,10 @@ NTSTATUS rpccli_winreg_QueryMultipleValues(struct rpc_pipe_client *cli,
 	/* Return variables */
 	memcpy(values, r.out.values, (r.in.num_values) * sizeof(*values));
 	if (buffer && r.out.buffer) {
-		memcpy(buffer, r.out.buffer, (*r.in.buffer_size) * sizeof(*buffer));
+		if ((*r.out.buffer_size) > (*r.in.buffer_size)) {
+			return NT_STATUS_INVALID_NETWORK_RESPONSE;
+		}
+		memcpy(buffer, r.out.buffer, (*r.out.buffer_size) * sizeof(*buffer));
 	}
 	*buffer_size = *r.out.buffer_size;
 
diff --git a/librpc/ndr/libndr.h b/librpc/ndr/libndr.h
index ff7c912..203f7bf 100644
--- a/librpc/ndr/libndr.h
+++ b/librpc/ndr/libndr.h
@@ -543,6 +543,7 @@ enum ndr_err_code ndr_push_charset(struct ndr_push *ndr, int ndr_flags, const ch
 
 /* GUIDs */
 bool GUID_equal(const struct GUID *u1, const struct GUID *u2);
+NTSTATUS GUID_from_ndr_blob(const DATA_BLOB *b, struct GUID *guid);
 NTSTATUS GUID_from_data_blob(const DATA_BLOB *s, struct GUID *guid);
 NTSTATUS GUID_from_string(const char *s, struct GUID *guid);
 NTSTATUS NS_GUID_from_string(const char *s, struct GUID *guid);
diff --git a/librpc/ndr/uuid.c b/librpc/ndr/uuid.c
index 2b47246..9289712 100644
--- a/librpc/ndr/uuid.c
+++ b/librpc/ndr/uuid.c
@@ -25,6 +25,25 @@
 #include "librpc/ndr/libndr.h"
 #include "librpc/gen_ndr/ndr_misc.h"
 
+
+/**
+  build a GUID from a NDR data blob
+*/
+_PUBLIC_ NTSTATUS GUID_from_ndr_blob(const DATA_BLOB *b, struct GUID *guid)
+{
+	enum ndr_err_code ndr_err;
+	TALLOC_CTX *mem_ctx;
+
+	mem_ctx = talloc_new(NULL);
+	NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
+
+	ndr_err = ndr_pull_struct_blob_all(b, mem_ctx, NULL, guid,
+					   (ndr_pull_flags_fn_t)ndr_pull_GUID);
+	talloc_free(mem_ctx);
+	return ndr_map_error2ntstatus(ndr_err);
+}
+
+
 /**
   build a GUID from a string
 */
@@ -81,29 +100,16 @@ _PUBLIC_ NTSTATUS GUID_from_data_blob(const DATA_BLOB *s, struct GUID *guid)
 	} else if (s->length == 32) {
 		size_t rlen = strhex_to_str((char *)blob16.data, blob16.length,
 					    (const char *)s->data, s->length);
-		if (rlen == blob16.length) {
-			/* goto the ndr_pull_struct_blob() path */
-			status = NT_STATUS_OK;
-			s = &blob16;
+		if (rlen != blob16.length) {
+			return NT_STATUS_INVALID_PARAMETER;
 		}
+
+		s = &blob16;
+		return GUID_from_ndr_blob(s, guid);
 	}
 
 	if (s->length == 16) {
-		enum ndr_err_code ndr_err;
-		struct GUID guid2;
-		TALLOC_CTX *mem_ctx;
-
-		mem_ctx = talloc_new(NULL);
-		NT_STATUS_HAVE_NO_MEMORY(mem_ctx);
-
-		ndr_err = ndr_pull_struct_blob(s, mem_ctx, NULL, &guid2,
-					       (ndr_pull_flags_fn_t)ndr_pull_GUID);
-		talloc_free(mem_ctx);
-		if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-			return ndr_map_error2ntstatus(ndr_err);
-		}


-- 
Samba Shared Repository


More information about the samba-cvs mailing list