| commit | 3a123fbbe86dbc8dba8612095554bff8309ab381 | |
| author | Jeremy Allison <jra@samba.org> | |
| Fri, 11 Aug 2023 17:42:41 +0000 (11 10:42 -0700) | ||
| committer | Jule Anger <janger@samba.org> | |
| Wed, 16 Aug 2023 08:47:14 +0000 (16 08:47 +0000) | ||
| tree | f911324f8c2853f9c8cf7e63c769147e05a2c139 | treesnapshot (tar.gz zip) |
| parent | ec8887be3f6f128911be4855c6ad302140d4d5ff | commitdiff |
s3: smbd: Ensure srvstr_pull_req_talloc() always NULLs out *dest.
Robert Morris <rtm@lcs.mit.edu> noticed that in the case
where srvstr_pull_req_talloc() is being called with
buffer remaining == 0, we don't NULL out the destination
pointed which is *always* done in the codepaths inside
pull_string_talloc(). This prevents a crash in the caller.
Remove knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15420
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 9220c45cc191b34e293190f6a923ba463edd5db9)
Robert Morris <rtm@lcs.mit.edu> noticed that in the case
where srvstr_pull_req_talloc() is being called with
buffer remaining == 0, we don't NULL out the destination
pointed which is *always* done in the codepaths inside
pull_string_talloc(). This prevents a crash in the caller.
Remove knownfail.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15420
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
(cherry picked from commit 9220c45cc191b34e293190f6a923ba463edd5db9)
| selftest/knownfail.d/smb1_truncated_sessetup | [deleted file] | blobblamehistory |
| source3/smbd/smb2_reply.c | diffblobblamehistory |