| commit | db5ccb70b6ac51ea263889cc9cdd523673ae8ecd | |
| author | Steven Danneman <steven.danneman@isilon.com> | |
| Sat, 30 Jan 2010 21:29:23 +0000 (30 13:29 -0800) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Thu, 4 Feb 2010 10:09:24 +0000 (4 11:09 +0100) | ||
| tree | cf55067b328ea98b08c5a5e074f9f132db3b98e2 | treesnapshot (tar.gz zip) |
| parent | ad17c1ab08e15ebf1d3d3aac1e874e9602a15e75 | commitdiff |
s3/smbd: Fix string buffer overflow causing heap corruption
The destname malloc size was not taking into account the 1 extra byte
needed if a string without a leading '/' was passed in and that slash
was added.
This would cause the '\0' byte to be written past the end of the
malloced destname string and corrupt whatever heap memory was there.
This problem would be hit if a share name was given in smb.conf without
a leading '/' and if it was the exact size of the allocated STRDUP memory
which in some implementations of malloc is a power of 2.
(cherry picked from commit f42971c520360e69c4cdd64bebb02a5f5ba49b94)
Fix bug #7096.
The destname malloc size was not taking into account the 1 extra byte
needed if a string without a leading '/' was passed in and that slash
was added.
This would cause the '\0' byte to be written past the end of the
malloced destname string and corrupt whatever heap memory was there.
This problem would be hit if a share name was given in smb.conf without
a leading '/' and if it was the exact size of the allocated STRDUP memory
which in some implementations of malloc is a power of 2.
(cherry picked from commit f42971c520360e69c4cdd64bebb02a5f5ba49b94)
Fix bug #7096.
| source3/smbd/service.c | diffblobblamehistory |