diff options
| author | Andrew Walker <awalker@ixsystems.com> | 2022-12-19 08:17:47 -0500 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2022-12-20 18:49:54 +0000 |
| commit | 5b19288949e97a5af742ff2719992d56f21e364a (patch) | |
| tree | 1e841c57102412885690e31ebbb528ff7a1c30cf /source3/param | |
| parent | 57ff5a33e9f4f1ff9677e44e75005e713b0a5607 (diff) | |
| download | samba-5b19288949e97a5af742ff2719992d56f21e364a.tar.gz | |
s3:params:lp_do_section - protect against NULL deref
iServiceIndex may indicate an empty slot in the ServicePtrs
array. In this case, lpcfg_serivce_ok(ServicePtrs[iServiceIndex])
may trigger a NULL deref and crash. Skipping the check
here will cause a scan of the array in add_a_service() and the
NULL slot will be used safely.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15267
Signed-off-by: Andrew Walker <awalker@ixsystems.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Dec 20 18:49:54 UTC 2022 on sn-devel-184
Diffstat (limited to 'source3/param')
| -rw-r--r-- | source3/param/loadparm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c index ad24ae7e9e7..56a8bc2d28b 100644 --- a/source3/param/loadparm.c +++ b/source3/param/loadparm.c @@ -2886,7 +2886,7 @@ bool lp_do_section(const char *pszSectionName, void *userdata) /* if we have a current service, tidy it up before moving on */ bRetval = true; - if (iServiceIndex >= 0) + if ((iServiceIndex >= 0) && (ServicePtrs[iServiceIndex] != NULL)) bRetval = lpcfg_service_ok(ServicePtrs[iServiceIndex]); /* if all is still well, move to the next record in the services array */ |