[SCM] Samba Shared Repository - branch v3-5-test updated

Karolin Seeger kseeger at samba.org
Mon Apr 4 12:47:47 MDT 2011


The branch, v3-5-test has been updated
       via  3e0f539 alpha_strcpy() is a utility function which reportedly: Strips out all but 'a-Z0-9' and the character in other_safe_chars and replaces with '_'.
       via  bb3ed43 Fix bug 8040 - smbclient segfaults when a Cyrillic netbios name or workgroup is configured.
      from  90e7f31 Fix bug #7996 - sgid bit lost on folder rename.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-5-test


- Log -----------------------------------------------------------------
commit 3e0f539596fbb867b672eeaff037e81c33428309
Author: David Disseldorp <ddiss at suse.de>
Date:   Fri Apr 1 11:21:59 2011 -0700

    alpha_strcpy() is a utility function which reportedly: Strips out all but 'a-Z0-9' and the character in other_safe_chars and replaces with '_'.
    
    This statement does not currently hold true in all cases (e.g. src =
    "ТАНЦЕВАТЬ").
    
    Part of a fix for bug 8040 - smbclient segfaults when a Cyrillic netbios
    name or workgroup is configured.

commit bb3ed43584e6d2c4d64b5f7b9e70a7db7f3e859d
Author: Jeremy Allison <jra at samba.org>
Date:   Fri Mar 25 15:12:12 2011 -0700

    Fix bug 8040 - smbclient segfaults when a Cyrillic netbios name or workgroup is configured.
    
    As discovered by David Disseldorp <ddiss at suse.de>, convert_string_talloc()
    doesn't always return consistent results for a zero length string. The
    API states an incoming string must *always* contain the terminating null,
    but unfotunately too much code expects passing in a zero source length
    to return a null terminated string, so at least ensure we return a
    correct null string in the required character set and return the
    correct length.
    
    Also ensure we cannot return a zero length for a converted string
    (we ensure that the returned buffer is always allocated and zero
    terminated anyway) as calling code depends on the fact that returning
    true from this function will *always* return a non-zero length (as
    it must include the terminating null).
    
    Note this is a different fix from what went into master (this is
    identical to the fix I'm planning for 3.5.x) as convert_string_talloc()
    has diverged between the two.
    
    Jeremy.

-----------------------------------------------------------------------

Summary of changes:
 source3/lib/charcnv.c  |   24 ++++++++++++++++++++++--
 source3/lib/util_str.c |   12 +++++++++---
 2 files changed, 31 insertions(+), 5 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/lib/charcnv.c b/source3/lib/charcnv.c
index 718f810..743f748 100644
--- a/source3/lib/charcnv.c
+++ b/source3/lib/charcnv.c
@@ -573,14 +573,24 @@ bool convert_string_talloc(TALLOC_CTX *ctx, charset_t from, charset_t to,
 		errno = EINVAL;
 		return false;
 	}
+
 	if (srclen == 0) {
-		ob = talloc_strdup(ctx, "");
+		/* We really should treat this as an error, but
+		   there are too many callers that need this to
+		   return a NULL terminated string in the correct
+		   character set. */
+		if (to == CH_UTF16LE|| to == CH_UTF16BE || to == CH_UTF16MUNGED) {
+			destlen = 2;
+		} else {
+			destlen = 1;
+		}
+		ob = talloc_zero_array(ctx, char, destlen);
 		if (ob == NULL) {
 			errno = ENOMEM;
 			return false;
 		}
+		*converted_size = destlen;
 		*dest = ob;
-		*converted_size = 0;
 		return true;
 	}
 
@@ -677,6 +687,16 @@ bool convert_string_talloc(TALLOC_CTX *ctx, charset_t from, charset_t to,
 	ob[destlen] = '\0';
 	ob[destlen+1] = '\0';
 
+	/* Ensure we can never return a *converted_size of zero. */
+	if (destlen == 0) {
+		/* This can happen from a bad iconv "use_as_is:" call. */
+		if (to == CH_UTF16LE|| to == CH_UTF16BE || to == CH_UTF16MUNGED) {
+			destlen = 2;
+		} else {
+			destlen = 1;
+		}
+	}
+
 	*converted_size = destlen;
 	return true;
 
diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index 3da2b83..d869637 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -586,7 +586,9 @@ char *safe_strcat_fn(const char *fn,
  Paranoid strcpy into a buffer of given length (includes terminating
  zero. Strips out all but 'a-Z0-9' and the character in other_safe_chars
  and replaces with '_'. Deliberately does *NOT* check for multibyte
- characters. Don't change it !
+ characters. Treats src as an array of bytes, not as a multibyte
+ string. Any byte >0x7f is automatically converted to '_'.
+ other_safe_chars must also contain an ascii string (bytes<0x7f).
 **/
 
 char *alpha_strcpy_fn(const char *fn,
@@ -622,8 +624,12 @@ char *alpha_strcpy_fn(const char *fn,
 
 	for(i = 0; i < len; i++) {
 		int val = (src[i] & 0xff);
-		if (isupper_ascii(val) || islower_ascii(val) ||
-				isdigit(val) || strchr_m(other_safe_chars, val))
+		if (val > 0x7f) {
+			dest[i] = '_';
+			continue;
+		}
+		if (isupper(val) || islower(val) ||
+				isdigit(val) || strchr(other_safe_chars, val))
 			dest[i] = src[i];
 		else
 			dest[i] = '_';


-- 
Samba Shared Repository


More information about the samba-cvs mailing list