| commit | 116c740cb9c30bc2471dcb7ba2a771c86b02061a | |
| author | Jeremy Allison <jra@samba.org> | |
| Fri, 11 Aug 2023 17:42:41 +0000 (11 10:42 -0700) | ||
| committer | Jule Anger <janger@samba.org> | |
| Tue, 15 Aug 2023 14:20:09 +0000 (15 14:20 +0000) | ||
| tree | 6bca6da68be159164e79128f104d2bcaba5923d3 | treesnapshot (tar.gz zip) |
| parent | 60cbe064ba1fcbc3b53c54d2ba4a04cf1f8f91ce | commitdiff |
s3: smbd: Ensure srvstr_pull_req_talloc() always NULLs out *dest.
Robert Morris <rtm@lcs.mit.edu> noticed that in the case
where srvstr_pull_req_talloc() is being called with
buffer remaining == 0, we don't NULL out the destination
pointed which is *always* done in the codepaths inside
pull_string_talloc(). This prevents a crash in the caller.
Remove knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15420
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 9220c45cc191b34e293190f6a923ba463edd5db9)
Robert Morris <rtm@lcs.mit.edu> noticed that in the case
where srvstr_pull_req_talloc() is being called with
buffer remaining == 0, we don't NULL out the destination
pointed which is *always* done in the codepaths inside
pull_string_talloc(). This prevents a crash in the caller.
Remove knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15420
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 9220c45cc191b34e293190f6a923ba463edd5db9)
| selftest/knownfail.d/smb1_truncated_sessetup | [deleted file] | blobblamehistory |
| source3/smbd/smb2_reply.c | diffblobblamehistory |