smbd crashed in posix_acls.c:process_deny_list

[yanhuan]

Hi:
My smbd crashed when setting windows acl, my samba version is 3.6.16, here is a small piece of log.smbd:
 
[2014/01/23 10:24:06.204184, 10] smbd/posix_acls.c:848(print_canon_ace_list)
print_canon_ace_list: file ace - before deny
canon_ace index 0. Type = deny SID = S-1-5-7 gid 16777223 (16777223) SMB_ACL_GROUP ace_flags = 0x0 perms rwx
canon_ace index 1. Type = deny SID = S-1-1-0 other SMB_ACL_OTHER ace_flags = 0x0 perms rwx
*** glibc detected *** smbd: malloc(): memory corruption: 0x00002b0acaeb21c0 ***
 
The program went to the codes posix_acls.c:process_deny_list below:
if (curr_ace->perms == ALL_ACE_PERMS) {
 
/*
* Optimisation. This is a DENY_ALL to Everyone. Truncate the
* list at this point including this entry.
*/
 
canon_ace *prev_entry = DLIST_PREV(curr_ace);
 
free_canon_ace_list( curr_ace );
if (prev_entry)
DLIST_REMOVE(ace_list, prev_entry);
else {
/* We deleted the entire list. */
ace_list = NULL;
}
break;
}
 
I think we should set prev_entry->next = NULL and ace_list->prev = curr_ace->prev before calling free_canon_ace_list.
But I want more, as this is a DENY_ALL to everyone, it would be OK to remove the entire list. I rewrite the codes below:
free_canon_ace_list(ace_list);
ace_list = NULL;
break;
Please let me know if I am right. Thank you.
 
P.S.
I enabled windows acl with parameters below:
vfs objects=acl_xattr 
map acl inherit=yes 
inherit acls=yes 
store dos attributes=yes
dos filemode=yes
ea support=yes




严欢
天津中科蓝鲸信息技术有限公司
手机：13622075525 
Email：yanhuan at bwstor.com.cn
-------------- next part --------------
A non-text attachment was scrubbed...
Name: log.smbd
Type: application/octet-stream
Size: 204997 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20140123/0a8b4840/attachment-0001.obj>