[SCM] Samba Shared Repository - branch master updated

[Karolin Seeger]

The branch, master has been updated
       via  33f88ab s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown.
       via  deda043 s3: smbd: Fix SMB1 use-after-free crash bug. CVE-2017-14746
      from  8212c34 docs: Fix the "aio r/w size" smb.conf entries

https://git.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 33f88abe6b14cf86360efd98ab4b66520244c2a7
Author: Jeremy Allison <jra at samba.org>
Date:   Wed Sep 20 11:04:50 2017 -0700

    s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown.
    
    Ensure we zero out unused grown area.
    
    CVE-2017-15275
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13077
    
    Signed-off-by: Jeremy Allison <jra at samba.org>
    
    Autobuild-User(master): Karolin Seeger <kseeger at samba.org>
    Autobuild-Date(master): Tue Nov 21 19:42:22 CET 2017 on sn-devel-144

commit deda04389a7e0baddb88d4d611a6f07926776b28
Author: Jeremy Allison <jra at samba.org>
Date:   Tue Sep 19 16:11:33 2017 -0700

    s3: smbd: Fix SMB1 use-after-free crash bug. CVE-2017-14746
    
    When setting up the chain, always use 'next->' variables
    not the 'req->' one.
    
    Bug discovered by 连一汉 <lianyihan at 360.cn>
    
    BUG: https://bugzilla.samba.org/show_bug.cgi?id=13041
    
    Signed-off-by: Jeremy Allison <jra at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/process.c |  7 ++++---
 source3/smbd/reply.c   |  5 +++++
 source3/smbd/srvstr.c  | 14 ++++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 11a5ae8..b5f528f 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -1855,12 +1855,13 @@ void smb_request_done(struct smb_request *req)
 
 		next->vuid = SVAL(req->outbuf, smb_uid);
 		next->tid  = SVAL(req->outbuf, smb_tid);
-		status = smb1srv_tcon_lookup(req->xconn, req->tid,
+		status = smb1srv_tcon_lookup(req->xconn, next->tid,
 					     now, &tcon);
+
 		if (NT_STATUS_IS_OK(status)) {
-			req->conn = tcon->compat;
+			next->conn = tcon->compat;
 		} else {
-			req->conn = NULL;
+			next->conn = NULL;
 		}
 		next->chain_fsp = req->chain_fsp;
 		next->inbuf = req->inbuf;
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 9c82ebf..623f83b 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -923,6 +923,11 @@ void reply_tcon_and_X(struct smb_request *req)
 		}
 
 		TALLOC_FREE(tcon);
+		/*
+		 * This tree id is gone. Make sure we can't re-use it
+		 * by accident.
+		 */
+		req->tid = 0;
 	}
 
 	if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
diff --git a/source3/smbd/srvstr.c b/source3/smbd/srvstr.c
index 56dceba..c2d70b3 100644
--- a/source3/smbd/srvstr.c
+++ b/source3/smbd/srvstr.c
@@ -110,6 +110,20 @@ ssize_t message_push_string(uint8_t **outbuf, const char *str, int flags)
 		DEBUG(0, ("srvstr_push failed\n"));
 		return -1;
 	}
+
+	/*
+	 * Ensure we clear out the extra data we have
+	 * grown the buffer by, but not written to.
+	 */
+	if (buf_size + result < buf_size) {
+		return -1;
+	}
+	if (grow_size < result) {
+		return -1;
+	}
+
+	memset(tmp + buf_size + result, '\0', grow_size - result);
+
 	set_message_bcc((char *)tmp, smb_buflen(tmp) + result);
 
 	*outbuf = tmp;


-- 
Samba Shared Repository