https://bugzilla.samba.org/show_bug.cgi?id=10766

[Stefan (metze) Metzmacher]

Hi,

I noticed the following bug report

https://bugzilla.samba.org/show_bug.cgi?id=10766
segfault in smbXsrv_session_create()

Here's a possible fix for master.

Please review and push.

metze

-------------- next part --------------
From 9da5e518a3811af6bbaea239e4fc05c047bde7c5 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze at samba.org>
Date: Tue, 19 Aug 2014 00:15:34 +0200
Subject: [PATCH] s3:smbd: close the connection if the client doesn't start
 with a SMB1 Negprot

The case where the client starts with a SMB2 Negprot is already handled
in smbd_smb2_request_dispatch().

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10766

Signed-off-by: Stefan Metzmacher <metze at samba.org>
---
 source3/smbd/process.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 7148462..48e4b65 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -1629,6 +1629,12 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req)
 		}
 	}
 
+	if (!xconn->smb1.negprot.done) {
+		if (smb_messages[type].fn != reply_negprot) {
+			exit_server_cleanly("The first request has to be a negprot");
+		}
+	}
+
 	smb_messages[type].fn(req);
 	return req->conn;
 }
-- 
1.9.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20140903/41a9a0ba/attachment.pgp>