diff options
| author | Volker Lendecke <vl@samba.org> | 2016-03-10 08:54:54 +0100 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2016-03-11 00:12:18 +0100 |
| commit | 9341c02a8998a860d4f390bba2556555a138c71b (patch) | |
| tree | d1eaaf230a6a3a6aeab54283637bdac7d55ae2f7 /source3/smbd/smbXsrv_session.c | |
| parent | a971cfe0ef47c02d119261596c0705275e17e613 (diff) | |
| download | samba-9341c02a8998a860d4f390bba2556555a138c71b.tar.gz | |
smbd: Prevent a crash
smb2srv_session_close_previous_check crashes if
ndr_pull_smbXsrv_session_globalB fails for some reason. It depends on "is_free"
to be correctly set. All we can do for an invalid database is to discard the
record and set it free.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Mar 11 00:12:18 CET 2016 on sn-devel-144
Diffstat (limited to 'source3/smbd/smbXsrv_session.c')
| -rw-r--r-- | source3/smbd/smbXsrv_session.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/source3/smbd/smbXsrv_session.c b/source3/smbd/smbXsrv_session.c index a5aee8c7b24..cdad47f0e3d 100644 --- a/source3/smbd/smbXsrv_session.c +++ b/source3/smbd/smbXsrv_session.c @@ -833,6 +833,10 @@ static void smbXsrv_session_global_verify_record(struct db_record *db_rec, hex_encode_talloc(frame, key.dptr, key.dsize), nt_errstr(status))); TALLOC_FREE(frame); + *is_free = true; + if (was_free) { + *was_free = true; + } return; } @@ -848,6 +852,10 @@ static void smbXsrv_session_global_verify_record(struct db_record *db_rec, global_blob.version)); NDR_PRINT_DEBUG(smbXsrv_session_globalB, &global_blob); TALLOC_FREE(frame); + *is_free = true; + if (was_free) { + *was_free = true; + } return; } |