[Pkg-samba-maint] r1605 - in branches/samba/etch/debian: . patches

[vorlon at alioth.debian.org]

Author: vorlon
Date: 2007-11-25 01:21:30 +0000 (Sun, 25 Nov 2007)
New Revision: 1605

Modified:
   branches/samba/etch/debian/changelog
   branches/samba/etch/debian/patches/security-CVE-2007-4572_part2.patch
Log:
Fix for one final regression related to the fix for CVE-2007-4572, pulled
from upstream.  Thanks to Santiago Garcia Mantinan <manty at debian.org> for
catching this.



Modified: branches/samba/etch/debian/changelog
===================================================================
--- branches/samba/etch/debian/changelog	2007-11-24 10:11:10 UTC (rev 1604)
+++ branches/samba/etch/debian/changelog	2007-11-25 01:21:30 UTC (rev 1605)
@@ -1,3 +1,11 @@
+samba (3.0.24-6etch7) stable-security; urgency=low
+
+  * Fix for one final regression related to the fix for CVE-2007-4572,
+    pulled from upstream.  Thanks to Santiago Garcia Mantinan
+    <manty at debian.org> for catching this.
+
+ -- Steve Langasek <vorlon at debian.org>  Sat, 24 Nov 2007 02:17:06 -0800
+
 samba (3.0.24-6etch6) stable-security; urgency=high
 
   * debian/patches/security-CVE-2007-4572_part2.patch: fix a regression

Modified: branches/samba/etch/debian/patches/security-CVE-2007-4572_part2.patch
===================================================================
--- branches/samba/etch/debian/patches/security-CVE-2007-4572_part2.patch	2007-11-24 10:11:10 UTC (rev 1604)
+++ branches/samba/etch/debian/patches/security-CVE-2007-4572_part2.patch	2007-11-25 01:21:30 UTC (rev 1605)
@@ -238,3 +238,20 @@
  				pdata += len;
  				data_size = PTR_DIFF(pdata,(*ppdata));
  
+diff --git a/source/smbd/sesssetup.c b/source/smbd/sesssetup.c
+index 05a5962..058faed 100644
+--- a/source/smbd/sesssetup.c
++++ b/source/smbd/sesssetup.c
+@@ -68,9 +68,9 @@ static int add_signature(char *outbuf, char *p)
+ 
+ 	fstr_sprintf( lanman, "Samba %s", SAMBA_VERSION_STRING);
+ 
+-	p += srvstr_push(outbuf, p, "Unix", -1, STR_TERMINATE);
+-	p += srvstr_push(outbuf, p, lanman, -1, STR_TERMINATE);
+-	p += srvstr_push(outbuf, p, lp_workgroup(), -1, STR_TERMINATE);
++	p += srvstr_push(outbuf, p, "Unix", BUFFER_SIZE - (p - outbuf), STR_TERMINATE);
++	p += srvstr_push(outbuf, p, lanman, BUFFER_SIZE - (p - outbuf), STR_TERMINATE);
++	p += srvstr_push(outbuf, p, lp_workgroup(), BUFFER_SIZE - (p - outbuf), STR_TERMINATE);
+ 
+ 	return PTR_DIFF(p, start);
+ }