| commit | ac32a770fc1fad988629654039119278e0c1afa4 | |
| author | Jeremy Allison <jra@samba.org> | |
| Wed, 29 Nov 2017 17:21:30 +0000 (29 09:21 -0800) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Tue, 5 Dec 2017 09:34:27 +0000 (5 10:34 +0100) | ||
| tree | 4d3487b6b71d66cb6725146cd514fab48dde199d | treesnapshot (tar.gz zip) |
| parent | 0fcdf5db90a05ee95c30ddfa32f3868702b77628 | commitdiff |
s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv().
cli_smb2_close_fnum_recv() uses tevent_req_simple_recv_ntstatus(req), which
frees req, then uses the state pointer which was owned by req.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13171
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Nov 30 05:47:12 CET 2017 on sn-devel-144
(cherry picked from commit 5c8032b6b8ce4439b3ef8f43a62a419f081eb787)
cli_smb2_close_fnum_recv() uses tevent_req_simple_recv_ntstatus(req), which
frees req, then uses the state pointer which was owned by req.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13171
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Böhme <slow@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Thu Nov 30 05:47:12 CET 2017 on sn-devel-144
(cherry picked from commit 5c8032b6b8ce4439b3ef8f43a62a419f081eb787)
| source3/libsmb/cli_smb2_fnum.c | diffblobblamehistory |