Segmentation fault in nmbd when working with Dave 2.5.2

[Philip Higgins]

The problem seems to be that whenever Samba becomes LMB for a subnet, Dave
sends a series of broadcast netbios-dgm packets that cause nmbd to segfault.

This is only a problem with Dave 2.5.2, Dave 2.5.1 works fine.
It occurs consistently, with Samba 2.0.7 and 2.2.0 on linux (Redhat on x86),
NetBSD (on mips) and OpenBSD (x86). That pretty much rules out operating
system or hardware failure. ;)

Log files and stack trace available at
http://gi101.ocsstud.gu.edu.au/log.smbd
http://gi101.ocsstud.gu.edu.au/log.nmbd
http://gi101.ocsstud.gu.edu.au/stacktrace.nmbd

Plus tcpdump output for the session at
http://gi101.ocsstud.gu.edu.au/tcpdump.out

The 'killer' packets are right at the end of the tcpdump log, three
broadcast packets from 'bb305.ocsstud.gu.edu.au', which is running Dave
2.5.2 on Mac OS 9.1.

Samba functions normally if packets to that port from that machine are
blocked, and dies within minutes otherwise.
Samba also functions fine when not running as an LMB for that subnet.

I don't know enough of the smb protocol to know if the latest version of
Dave is actually breaking it, but either way, I don't think a segmentation
fault is the correct response from samba.

Please email me if you require any further information or testing, I will be
glad to help.

Philip Higgins