| commit | c7b1876ac53fc82283c0673ff04b1e47de34a78b | |
| author | Jeremy Allison <jra@samba.org> | |
| Sat, 12 Aug 2023 00:14:38 +0000 (11 17:14 -0700) | ||
| committer | Jule Anger <janger@samba.org> | |
| Thu, 17 Aug 2023 09:27:17 +0000 (17 09:27 +0000) | ||
| tree | 9c07847b2e1f6c81d0dc67600638aedf437bcb2c | treesnapshot (tar.gz zip) |
| parent | 68c74742ed950eba7ac840da460b1b162b934654 | commitdiff |
s3: smbd: init_smb1_request() isn't being passed zero'ed memory from any codepath.
If a client does a SMB1 NEGPROT followed by SMB1 TCON
then req->session is left uninitialized.
Show this causes a crash by deliberately initializing
req->session to an invalid pointer. This will be removed
once the test shows the crash, and the fix is added to
cause init_smb1_request() to zero the memory passed in.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15432
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
(cherry picked from commit f02f74e931f5821c7b7c1be2b8f0fb60c9a69b19)
If a client does a SMB1 NEGPROT followed by SMB1 TCON
then req->session is left uninitialized.
Show this causes a crash by deliberately initializing
req->session to an invalid pointer. This will be removed
once the test shows the crash, and the fix is added to
cause init_smb1_request() to zero the memory passed in.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15432
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
(cherry picked from commit f02f74e931f5821c7b7c1be2b8f0fb60c9a69b19)
| source3/smbd/smb2_process.c | diffblobblamehistory |