https://bugzilla.samba.org/show_bug.cgi?id=10766

[Jeremy Allison]

On Wed, Sep 03, 2014 at 06:34:06PM +0200, Stefan (metze) Metzmacher wrote:
> Hi,
> 
> I noticed the following bug report
> 
> https://bugzilla.samba.org/show_bug.cgi?id=10766
> segfault in smbXsrv_session_create()
> 
> Here's a possible fix for master.
> 
> Please review and push.

Comparing against the function pointer, whilst
correct, is really ugly :-).

The function already has the type passed in,
so can't you do:

+       if (!xconn->smb1.negprot.done) {
+               if (type != SMBnegprot) {
+                       exit_server_cleanly("The first request has to be a negprot");
+               }
+       }

instead ? Just looks cleaner (IMHO).

> From 9da5e518a3811af6bbaea239e4fc05c047bde7c5 Mon Sep 17 00:00:00 2001
> From: Stefan Metzmacher <metze at samba.org>
> Date: Tue, 19 Aug 2014 00:15:34 +0200
> Subject: [PATCH] s3:smbd: close the connection if the client doesn't start
>  with a SMB1 Negprot
> 
> The case where the client starts with a SMB2 Negprot is already handled
> in smbd_smb2_request_dispatch().
> 
> Bug: https://bugzilla.samba.org/show_bug.cgi?id=10766
> 
> Signed-off-by: Stefan Metzmacher <metze at samba.org>
> ---
>  source3/smbd/process.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/source3/smbd/process.c b/source3/smbd/process.c
> index 7148462..48e4b65 100644
> --- a/source3/smbd/process.c
> +++ b/source3/smbd/process.c
> @@ -1629,6 +1629,12 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req)
>  		}
>  	}
>  
> +	if (!xconn->smb1.negprot.done) {
> +		if (smb_messages[type].fn != reply_negprot) {
> +			exit_server_cleanly("The first request has to be a negprot");
> +		}
> +	}
> +
>  	smb_messages[type].fn(req);
>  	return req->conn;
>  }
> -- 
> 1.9.1
>