[SCM] Samba Shared Repository - branch v4-17-test updated

Jule Anger janger at samba.org
Wed Jul 19 14:59:36 UTC 2023


The branch, v4-17-test has been updated
       via  8a602310ceb VERSION: Bump version up to Samba 4.17.11...
       via  5eceb0dfb4a VERSION: Disable GIT_SNAPSHOT for the 4.17.10 release.
       via  1448e347b2f WHATSNEW: Add release notes for Samba 4.17.10.
       via  56fad90eaef s3:rpc_server:netlogon: generate FAULT_INVALID_TAG for invalid netr_LogonGetCapabilities levels
       via  55d0a386012 s4:rpc_server:netlogon: generate FAULT_INVALID_TAG for invalid netr_LogonGetCapabilities levels
       via  e14a5c36123 s4:torture/rpc: let rpc.schannel also check netr_LogonGetCapabilities with different levels
       via  492a52b1c4c netlogon.idl: add support for netr_LogonGetCapabilities response level 2
       via  6c1128b1184 CVE-2023-3347: smbd: fix "server signing = mandatory"
       via  a22fcb68918 CVE-2023-3347: smbd: remove comment in smbd_smb2_request_process_negprot()
       via  95cec0dfa24 CVE-2023-3347: smbd: inline smb2_srv_init_signing() code in srv_init_signing()
       via  e96d5002fc1 CVE-2023-3347: smbd: pass lp_ctx to smb[1|2]_srv_init_signing()
       via  e67b7e5f88e CVE-2023-3347: CI: add a test for server-side mandatory signing
       via  091b0265fe4 CVE-2023-34968: mdssvc: return a fake share path
       via  a5c570e2629 CVE-2023-34968: mdscli: return share relative paths
       via  cb8313e7bee CVE-2023-34968: mdssvc: introduce an allocating wrapper to sl_pack()
       via  ee428be9c67 CVE-2023-34968: mdssvc: switch to doing an early return
       via  cc593a6ac53 CVE-2023-34968: mdssvc: remove response blob allocation
       via  449f1280b71 CVE-2023-34968: rpcclient: remove response blob allocation
       via  353a9ccea6f CVE-2023-34968: smbtorture: remove response blob allocation in mdssvc.c
       via  0ae6084d1a9 CVE-2023-34968: mdscli: remove response blob allocation
       via  56a21b3bc8f CVE-2023-34968: mdscli: use correct TALLOC memory context when allocating spotlight_blob
       via  47a0c1681dd CVE-2023-34968: mdssvc: add missing "kMDSStoreMetaScopes" dict key in slrpc_fetch_properties()
       via  98b2a013bc7 CVE-2023-34968: mdssvc: cache and reuse stat info in struct sl_inode_path_map
       via  049c1324564 CVE-2023-34967: mdssvc: add type checking to dalloc_value_for_key()
       via  7812c56d4cb CVE-2023-34967: CI: add a test for type checking of dalloc_value_for_key()
       via  c77b31f1bcb CVE-2023-34966: mdssvc: harden sl_unpack_loop()
       via  6e5e5c7f64e CVE-2023-34966: CI: test for sl_unpack_loop()
       via  53838682570 CVE-2022-2127: ntlm_auth: cap lanman response length value
       via  a3944de6990 CVE-2022-2127: winbindd: Fix WINBINDD_PAM_AUTH_CRAP length checks
      from  d48c42c7d26 VERSION: Bump version up to Samba 4.17.10...

https://git.samba.org/?p=samba.git;a=shortlog;h=v4-17-test


- Log -----------------------------------------------------------------
commit 8a602310cebc74e8958fb44dd5b7db83913ea9eb
Author: Jule Anger <janger at samba.org>
Date:   Wed Jul 19 16:57:43 2023 +0200

    VERSION: Bump version up to Samba 4.17.11...
    
    and re-enable GIT_SNAPSHOT.
    
    Signed-off-by: Jule Anger <janger at samba.org>

-----------------------------------------------------------------------

Summary of changes:
 VERSION                                       |   2 +-
 WHATSNEW.txt                                  |  77 +++++++-
 librpc/idl/netlogon.idl                       |   1 +
 python/samba/tests/blackbox/mdsearch.py       |   8 +-
 python/samba/tests/dcerpc/mdssvc.py           |  26 +--
 selftest/target/Samba3.pm                     |   1 +
 source3/rpc_client/cli_mdssvc.c               | 191 ++++++++++++++++----
 source3/rpc_client/cli_mdssvc_private.h       |   4 +
 source3/rpc_client/cli_mdssvc_util.c          | 148 ++++++++-------
 source3/rpc_client/cli_mdssvc_util.h          |   4 +
 source3/rpc_server/mdssvc/dalloc.c            |  14 +-
 source3/rpc_server/mdssvc/marshalling.c       |  45 +++--
 source3/rpc_server/mdssvc/marshalling.h       |   9 +-
 source3/rpc_server/mdssvc/mdssvc.c            | 142 ++++++++++-----
 source3/rpc_server/mdssvc/mdssvc.h            |   7 +-
 source3/rpc_server/mdssvc/srv_mdssvc_nt.c     |  32 ++--
 source3/rpc_server/netlogon/srv_netlog_nt.c   |  29 ++-
 source3/rpcclient/cmd_spotlight.c             |  48 +----
 source3/selftest/tests.py                     |   2 +
 source3/smbd/proto.h                          |   1 -
 source3/smbd/smb1_signing.c                   |  10 +-
 source3/smbd/smb1_signing.h                   |   3 +-
 source3/smbd/smb2_negprot.c                   |   6 -
 source3/smbd/smb2_signing.c                   |  23 +--
 source3/utils/ntlm_auth.c                     |   8 +-
 source3/winbindd/winbindd_pam_auth_crap.c     |  31 ++--
 source4/rpc_server/netlogon/dcerpc_netlogon.c |  28 ++-
 source4/torture/rpc/mdssvc.c                  | 250 +++++++++++++++++++++++---
 source4/torture/rpc/netlogon.c                |  77 +++++++-
 source4/torture/smb2/session.c                |  64 +++++++
 source4/torture/smb2/smb2.c                   |   1 +
 31 files changed, 971 insertions(+), 321 deletions(-)


Changeset truncated at 500 lines:

diff --git a/VERSION b/VERSION
index e4c70b77462..cbbdf8f46e5 100644
--- a/VERSION
+++ b/VERSION
@@ -25,7 +25,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=4
 SAMBA_VERSION_MINOR=17
-SAMBA_VERSION_RELEASE=10
+SAMBA_VERSION_RELEASE=11
 
 ########################################################
 # If a official release has a serious bug              #
diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 84dbe233384..674d70fe8b6 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,3 +1,77 @@
+                   ===============================
+                   Release Notes for Samba 4.17.10
+                            July 19, 2023
+                   ===============================
+
+
+This is a security release in order to address the following defects:
+
+o CVE-2022-2127:  When winbind is used for NTLM authentication, a maliciously
+                  crafted request can trigger an out-of-bounds read in winbind
+                  and possibly crash it.
+                  https://www.samba.org/samba/security/CVE-2022-2127.html
+
+o CVE-2023-3347:  SMB2 packet signing is not enforced if an admin configured
+                  "server signing = required" or for SMB2 connections to Domain
+                  Controllers where SMB2 packet signing is mandatory.
+                  https://www.samba.org/samba/security/CVE-2023-3347.html
+
+o CVE-2023-34966: An infinite loop bug in Samba's mdssvc RPC service for
+                  Spotlight can be triggered by an unauthenticated attacker by
+                  issuing a malformed RPC request.
+                  https://www.samba.org/samba/security/CVE-2023-34966.html
+
+o CVE-2023-34967: Missing type validation in Samba's mdssvc RPC service for
+                  Spotlight can be used by an unauthenticated attacker to
+                  trigger a process crash in a shared RPC mdssvc worker process.
+                  https://www.samba.org/samba/security/CVE-2023-34967.html
+
+o CVE-2023-34968: As part of the Spotlight protocol Samba discloses the server-
+                  side absolute path of shares and files and directories in
+                  search results.
+                  https://www.samba.org/samba/security/CVE-2023-34968.html
+
+
+Changes since 4.17.9
+--------------------
+
+o  Ralph Boehme <slow at samba.org>
+   * BUG 15072: CVE-2022-2127.
+   * BUG 15340: CVE-2023-34966.
+   * BUG 15341: CVE-2023-34967.
+   * BUG 15388: CVE-2023-34968.
+   * BUG 15397: CVE-2023-3347.
+
+o  Volker Lendecke <vl at samba.org>
+   * BUG 15072: CVE-2022-2127.
+
+o  Stefan Metzmacher <metze at samba.org>
+   * BUG 15418: Secure channel faulty since Windows 10/11 update 07/2023.
+
+
+#######################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical:matrix.org matrix room, or
+#samba-technical IRC channel on irc.libera.chat.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 4.1 and newer product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
                    ==============================
                    Release Notes for Samba 4.17.9
                            July 06, 2023
@@ -55,8 +129,7 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
                    ==============================
                    Release Notes for Samba 4.17.8
                             May 11, 2023
diff --git a/librpc/idl/netlogon.idl b/librpc/idl/netlogon.idl
index e563e114900..c77151af26b 100644
--- a/librpc/idl/netlogon.idl
+++ b/librpc/idl/netlogon.idl
@@ -1241,6 +1241,7 @@ interface netlogon
 	/* Function 0x15 */
 	typedef [switch_type(uint32)] union {
 		[case(1)] netr_NegotiateFlags server_capabilities;
+		[case(2)] netr_NegotiateFlags server_capabilities;
 	} netr_Capabilities;
 
 	NTSTATUS netr_LogonGetCapabilities(
diff --git a/python/samba/tests/blackbox/mdsearch.py b/python/samba/tests/blackbox/mdsearch.py
index c9156ae6e0e..c8e75661f15 100644
--- a/python/samba/tests/blackbox/mdsearch.py
+++ b/python/samba/tests/blackbox/mdsearch.py
@@ -76,10 +76,7 @@ class MdfindBlackboxTests(BlackboxTestCase):
         self.t.start()
         time.sleep(1)
 
-        pipe = mdssvc.mdssvc('ncacn_np:fileserver[/pipe/mdssvc]', self.get_loadparm())
-        conn = mdscli.conn(pipe, 'spotlight', '/foo')
-        self.sharepath = conn.sharepath()
-        conn.disconnect(pipe)
+        self.sharepath = os.environ["LOCAL_PATH"]
 
         for file in testfiles:
             f = open("%s/%s" % (self.sharepath, file), "w")
@@ -126,5 +123,4 @@ class MdfindBlackboxTests(BlackboxTestCase):
         output = self.check_output("mdsearch --configfile=%s -U %s%%%s fileserver spotlight '*==\"samba*\"'" % (config, username, password))
 
         actual = output.decode('utf-8').splitlines()
-        expected = ["%s/%s" % (self.sharepath, file) for file in testfiles]
-        self.assertEqual(expected, actual)
+        self.assertEqual(testfiles, actual)
diff --git a/python/samba/tests/dcerpc/mdssvc.py b/python/samba/tests/dcerpc/mdssvc.py
index b0df509ddc7..5002e5d26d6 100644
--- a/python/samba/tests/dcerpc/mdssvc.py
+++ b/python/samba/tests/dcerpc/mdssvc.py
@@ -84,10 +84,11 @@ class MdssvcTests(RpcInterfaceTestCase):
         self.t = threading.Thread(target=MdssvcTests.http_server, args=(self,))
         self.t.setDaemon(True)
         self.t.start()
+        self.sharepath = os.environ["LOCAL_PATH"]
         time.sleep(1)
 
         conn = mdscli.conn(self.pipe, 'spotlight', '/foo')
-        self.sharepath = conn.sharepath()
+        self.fakepath = conn.sharepath()
         conn.disconnect(self.pipe)
 
         for file in testfiles:
@@ -105,12 +106,11 @@ class MdssvcTests(RpcInterfaceTestCase):
         self.server.serve_forever()
 
     def run_test(self, query, expect, json_in, json_out):
-        expect = [s.replace("%BASEPATH%", self.sharepath) for s in expect]
         self.server.json_in = json_in.replace("%BASEPATH%", self.sharepath)
         self.server.json_out = json_out.replace("%BASEPATH%", self.sharepath)
 
         self.conn = mdscli.conn(self.pipe, 'spotlight', '/foo')
-        search = self.conn.search(self.pipe, query, self.sharepath)
+        search = self.conn.search(self.pipe, query, self.fakepath)
 
         # Give it some time, the get_results() below returns immediately
         # what's available, so if we ask to soon, we might get back no results
@@ -141,7 +141,7 @@ class MdssvcTests(RpcInterfaceTestCase):
             ]
           }
         }'''
-        exp_results = ["%BASEPATH%/foo", "%BASEPATH%/bar"]
+        exp_results = ["foo", "bar"]
         self.run_test('*=="samba*"', exp_results, exp_json_query, fake_json_response)
 
     def test_mdscli_search_escapes(self):
@@ -181,14 +181,14 @@ class MdssvcTests(RpcInterfaceTestCase):
           }
         }'''
         exp_results = [
-            r"%BASEPATH%/x+x",
-            r"%BASEPATH%/x*x",
-            r"%BASEPATH%/x=x",
-            r"%BASEPATH%/x'x",
-            r"%BASEPATH%/x?x",
-            r"%BASEPATH%/x x",
-            r"%BASEPATH%/x(x",
-            "%BASEPATH%/x\"x",
-            r"%BASEPATH%/x\x",
+            r"x+x",
+            r"x*x",
+            r"x=x",
+            r"x'x",
+            r"x?x",
+            r"x x",
+            r"x(x",
+            "x\"x",
+            r"x\x",
         ]
         self.run_test(sl_query, exp_results, exp_json_query, fake_json_response)
diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 9c590547c94..3336c5b8e97 100755
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -1294,6 +1294,7 @@ sub setup_ad_member_idmap_rid
 	# values required for tests to succeed
 	create krb5 conf = no
         map to guest = bad user
+	server signing = required
 ";
 
 	my $ret = $self->provision(
diff --git a/source3/rpc_client/cli_mdssvc.c b/source3/rpc_client/cli_mdssvc.c
index 046d37135cb..753bc2e52ed 100644
--- a/source3/rpc_client/cli_mdssvc.c
+++ b/source3/rpc_client/cli_mdssvc.c
@@ -43,10 +43,12 @@ char *mdscli_get_basepath(TALLOC_CTX *mem_ctx,
 struct mdscli_connect_state {
 	struct tevent_context *ev;
 	struct mdscli_ctx *mdscli_ctx;
+	struct mdssvc_blob response_blob;
 };
 
 static void mdscli_connect_open_done(struct tevent_req *subreq);
 static void mdscli_connect_unknown1_done(struct tevent_req *subreq);
+static void mdscli_connect_fetch_props_done(struct tevent_req *subreq);
 
 struct tevent_req *mdscli_connect_send(TALLOC_CTX *mem_ctx,
 				       struct tevent_context *ev,
@@ -111,6 +113,7 @@ static void mdscli_connect_open_done(struct tevent_req *subreq)
 	struct mdscli_connect_state *state = tevent_req_data(
 		req, struct mdscli_connect_state);
 	struct mdscli_ctx *mdscli_ctx = state->mdscli_ctx;
+	size_t share_path_len;
 	NTSTATUS status;
 
 	status = dcerpc_mdssvc_open_recv(subreq, state);
@@ -120,6 +123,18 @@ static void mdscli_connect_open_done(struct tevent_req *subreq)
 		return;
 	}
 
+	share_path_len = strlen(mdscli_ctx->mdscmd_open.share_path);
+	if (share_path_len < 1 || share_path_len > UINT16_MAX) {
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+	mdscli_ctx->mdscmd_open.share_path_len = share_path_len;
+
+	if (mdscli_ctx->mdscmd_open.share_path[share_path_len-1] == '/') {
+		mdscli_ctx->mdscmd_open.share_path[share_path_len-1] = '\0';
+		mdscli_ctx->mdscmd_open.share_path_len--;
+	}
+
 	subreq = dcerpc_mdssvc_unknown1_send(
 			state,
 			state->ev,
@@ -146,6 +161,8 @@ static void mdscli_connect_unknown1_done(struct tevent_req *subreq)
 		subreq, struct tevent_req);
 	struct mdscli_connect_state *state = tevent_req_data(
 		req, struct mdscli_connect_state);
+	struct mdscli_ctx *mdscli_ctx = state->mdscli_ctx;
+	struct mdssvc_blob request_blob;
 	NTSTATUS status;
 
 	status = dcerpc_mdssvc_unknown1_recv(subreq, state);
@@ -154,6 +171,108 @@ static void mdscli_connect_unknown1_done(struct tevent_req *subreq)
 		return;
 	}
 
+	status = mdscli_blob_fetch_props(state,
+					 state->mdscli_ctx,
+					 &request_blob);
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
+
+	subreq = dcerpc_mdssvc_cmd_send(state,
+					state->ev,
+					mdscli_ctx->bh,
+					&mdscli_ctx->ph,
+					0,
+					mdscli_ctx->dev,
+					mdscli_ctx->mdscmd_open.unkn2,
+					0,
+					mdscli_ctx->flags,
+					request_blob,
+					0,
+					mdscli_ctx->max_fragment_size,
+					1,
+					mdscli_ctx->max_fragment_size,
+					0,
+					0,
+					&mdscli_ctx->mdscmd_cmd.fragment,
+					&state->response_blob,
+					&mdscli_ctx->mdscmd_cmd.unkn9);
+	if (tevent_req_nomem(subreq, req)) {
+		return;
+	}
+	tevent_req_set_callback(subreq, mdscli_connect_fetch_props_done, req);
+	mdscli_ctx->async_pending++;
+	return;
+}
+
+static void mdscli_connect_fetch_props_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req = tevent_req_callback_data(
+		subreq, struct tevent_req);
+	struct mdscli_connect_state *state = tevent_req_data(
+		req, struct mdscli_connect_state);
+	struct mdscli_ctx *mdscli_ctx = state->mdscli_ctx;
+	DALLOC_CTX *d = NULL;
+	sl_array_t *path_scope_array = NULL;
+	char *path_scope = NULL;
+	NTSTATUS status;
+	bool ok;
+
+	status = dcerpc_mdssvc_cmd_recv(subreq, state);
+	TALLOC_FREE(subreq);
+	state->mdscli_ctx->async_pending--;
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
+
+	d = dalloc_new(state);
+	if (tevent_req_nomem(d, req)) {
+		return;
+	}
+
+	ok = sl_unpack(d,
+		       (char *)state->response_blob.spotlight_blob,
+		       state->response_blob.length);
+	if (!ok) {
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	path_scope_array = dalloc_value_for_key(d,
+						"DALLOC_CTX", 0,
+						"kMDSStorePathScopes",
+						"sl_array_t");
+	if (path_scope_array == NULL) {
+		DBG_ERR("Missing kMDSStorePathScopes\n");
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	path_scope = dalloc_get(path_scope_array, "char *", 0);
+	if (path_scope == NULL) {
+		DBG_ERR("Missing path in kMDSStorePathScopes\n");
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	mdscli_ctx->path_scope_len = strlen(path_scope);
+	if (mdscli_ctx->path_scope_len < 1 ||
+	    mdscli_ctx->path_scope_len > UINT16_MAX)
+	{
+		DBG_ERR("Bad path_scope: %s\n", path_scope);
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+	mdscli_ctx->path_scope = talloc_strdup(mdscli_ctx, path_scope);
+	if (tevent_req_nomem(mdscli_ctx->path_scope, req)) {
+		return;
+	}
+
+	if (mdscli_ctx->path_scope[mdscli_ctx->path_scope_len-1] == '/') {
+		mdscli_ctx->path_scope[mdscli_ctx->path_scope_len-1] = '\0';
+		mdscli_ctx->path_scope_len--;
+	}
+
 	tevent_req_done(req);
 }
 
@@ -276,15 +395,6 @@ struct tevent_req *mdscli_search_send(TALLOC_CTX *mem_ctx,
 		return tevent_req_post(req, ev);
 	}
 
-	state->response_blob.spotlight_blob = talloc_array(
-		state,
-		uint8_t,
-		mdscli_ctx->max_fragment_size);
-	if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
-		return tevent_req_post(req, ev);
-	}
-	state->response_blob.size = mdscli_ctx->max_fragment_size;
-
 	subreq = dcerpc_mdssvc_cmd_send(state,
 					ev,
 					mdscli_ctx->bh,
@@ -457,15 +567,6 @@ struct tevent_req *mdscli_get_results_send(
 		return tevent_req_post(req, ev);
 	}
 
-	state->response_blob.spotlight_blob = talloc_array(
-		state,
-		uint8_t,
-		mdscli_ctx->max_fragment_size);
-	if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
-		return tevent_req_post(req, ev);
-	}
-	state->response_blob.size = mdscli_ctx->max_fragment_size;
-
 	subreq = dcerpc_mdssvc_cmd_send(state,
 					ev,
 					mdscli_ctx->bh,
@@ -681,15 +782,6 @@ struct tevent_req *mdscli_get_path_send(TALLOC_CTX *mem_ctx,
 		return tevent_req_post(req, ev);
 	}
 
-	state->response_blob.spotlight_blob = talloc_array(
-		state,
-		uint8_t,
-		mdscli_ctx->max_fragment_size);
-	if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
-		return tevent_req_post(req, ev);
-	}
-	state->response_blob.size = mdscli_ctx->max_fragment_size;
-
 	subreq = dcerpc_mdssvc_cmd_send(state,
 					ev,
 					mdscli_ctx->bh,
@@ -724,7 +816,10 @@ static void mdscli_get_path_done(struct tevent_req *subreq)
 	struct mdscli_get_path_state *state = tevent_req_data(
 		req, struct mdscli_get_path_state);
 	DALLOC_CTX *d = NULL;
+	size_t pathlen;
+	size_t prefixlen;
 	char *path = NULL;
+	const char *p = NULL;
 	NTSTATUS status;
 	bool ok;
 
@@ -759,7 +854,38 @@ static void mdscli_get_path_done(struct tevent_req *subreq)
 		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 		return;
 	}
-	state->path = talloc_move(state, &path);
+
+	/* Path is prefixed by /PATHSCOPE/SHARENAME/, strip it */
+	pathlen = strlen(path);
+
+	/*
+	 * path_scope_len and share_path_len are already checked to be smaller
+	 * then UINT16_MAX so this can't overflow
+	 */
+	prefixlen = state->mdscli_ctx->path_scope_len
+		+ state->mdscli_ctx->mdscmd_open.share_path_len;
+
+	if (pathlen < prefixlen) {
+		DBG_DEBUG("Bad path: %s\n", path);
+		tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+		return;
+	}
+
+	p = path + prefixlen;
+	while (*p == '/') {
+		p++;
+	}
+	if (*p == '\0') {
+		DBG_DEBUG("Bad path: %s\n", path);
+		tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+		return;
+	}
+
+	state->path = talloc_strdup(state, p);
+	if (state->path == NULL) {
+		tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+		return;
+	}
 	DBG_DEBUG("path: %s\n", state->path);
 
 	tevent_req_done(req);
@@ -852,15 +978,6 @@ struct tevent_req *mdscli_close_search_send(TALLOC_CTX *mem_ctx,
 		return tevent_req_post(req, ev);
 	}
 
-	state->response_blob.spotlight_blob = talloc_array(
-		state,
-		uint8_t,
-		mdscli_ctx->max_fragment_size);
-	if (tevent_req_nomem(state->response_blob.spotlight_blob, req)) {
-		return tevent_req_post(req, ev);
-	}
-	state->response_blob.size = mdscli_ctx->max_fragment_size;
-
 	subreq = dcerpc_mdssvc_cmd_send(state,
 					ev,
 					mdscli_ctx->bh,
diff --git a/source3/rpc_client/cli_mdssvc_private.h b/source3/rpc_client/cli_mdssvc_private.h
index 031af85bf58..77f300c09cc 100644
--- a/source3/rpc_client/cli_mdssvc_private.h
+++ b/source3/rpc_client/cli_mdssvc_private.h
@@ -42,6 +42,7 @@ struct mdscli_ctx {
 	/* cmd specific or unknown fields */
 	struct {


-- 
Samba Shared Repository



More information about the samba-cvs mailing list