Memory corruption issue when samba4 is the target of a net vampire command

[Andrew Bartlett]

On Wed, 2010-10-27 at 18:52 +1100, Andrew Bartlett wrote:
> On Tue, 2010-10-26 at 17:23 +0200, Angelos Oikonomopoulos wrote:
> > Hello all,
> > 
> > I've been playing around with Samba 4 from git master (specifically 
> > 5785f08268bac332d09bdf71d1907ecb54f3b5bd from last Thursday). It seems 
> > to work well so far, but I've run into a bug when trying to add a second 
> > samba4 server as an additional DC, following the instructions in 
> > http://wiki.samba.org/index.php/Samba4/HOWTO/Join_a_domain_as_a_DC.
> > 
> > Specifically, the net vampire command described in that page crashes the 
> > existing DC pretty reliably. I've tried looking into it today but I 
> > think I'll need some help to track down the root cause (and produce a fix).
> 
> If this is reproducible, then put printf() statements in near every
> questionable variable.  valgrind will then complain when you print
> invalid things, now that it knows you expected it to be valid NOW,
> rather than later. 
> 
> I don't see from what you have sent why the task would not be valid.  It
> is passed in to the socket code at the top level, and ends up being
> passed to the accept handler. 

Also, liberal addition of talloc_get_type_abort() is often a quick way
to assert that pointers are current, valid memory. 

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Cisco Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 190 bytes
Desc: This is a digitally signed message part
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20101027/ba4def91/attachment.pgp>