[Pkg-samba-maint] r1643 - in branches/samba/sarge/debian: . patches

vorlon at alioth.debian.org vorlon at alioth.debian.org
Wed Nov 28 09:53:09 UTC 2007


Author: vorlon
Date: 2007-11-28 09:53:09 +0000 (Wed, 28 Nov 2007)
New Revision: 1643

Modified:
   branches/samba/sarge/debian/changelog
   branches/samba/sarge/debian/patches/security-CVE-2007-4572_part2.patch
Log:
Fix for yet another regression in the fix for CVE-2007-4572 due to one other
missed patch in the 3.0.27a diff.  Closes: #453050.



Modified: branches/samba/sarge/debian/changelog
===================================================================
--- branches/samba/sarge/debian/changelog	2007-11-28 09:42:08 UTC (rev 1642)
+++ branches/samba/sarge/debian/changelog	2007-11-28 09:53:09 UTC (rev 1643)
@@ -1,3 +1,10 @@
+samba (3.0.14a-3sarge10) oldstable-security; urgency=low
+
+  * Fix for yet another regression in the fix for CVE-2007-4572 due to one
+    other missed patch in the 3.0.27a diff.  Closes: #453050.
+
+ -- Steve Langasek <vorlon at debian.org>  Tue, 27 Nov 2007 23:42:21 -0800
+
 samba (3.0.14a-3sarge9) oldstable-security; urgency=low
 
   * Fix for one final regression related to the fix for CVE-2007-4572,

Modified: branches/samba/sarge/debian/patches/security-CVE-2007-4572_part2.patch
===================================================================
--- branches/samba/sarge/debian/patches/security-CVE-2007-4572_part2.patch	2007-11-28 09:42:08 UTC (rev 1642)
+++ branches/samba/sarge/debian/patches/security-CVE-2007-4572_part2.patch	2007-11-28 09:53:09 UTC (rev 1643)
@@ -74,12 +74,21 @@
 ===================================================================
 --- samba-3.0.24.orig/source/smbd/trans2.c
 +++ samba-3.0.24/source/smbd/trans2.c
+@@ -809,7 +809,7 @@
+ 				 char *path_mask,int dirtype,int info_level,
+ 				 int requires_resume_key,
+ 				 BOOL dont_descend,char **ppdata, 
+-				 char *base_data, int space_remaining, 
++				 char *base_data, char *end_data, int space_remaining, 
+ 				 BOOL *out_of_space, BOOL *got_exact_match,
+ 				 int *last_entry_off)
+ {
 @@ -985,7 +985,7 @@
  			p += l1_achName;
  			nameptr = p;
  			p += align_string(outbuf, p, 0);
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE);
  			if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) {
  				if (len > 2) {
  					SCVAL(nameptr, -1, len - 2);
@@ -88,7 +97,7 @@
  			p += l2_achName;
  			nameptr = p - 1;
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE | STR_NOALIGN);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE | STR_NOALIGN);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE | STR_NOALIGN);
  			if (SVAL(outbuf, smb_flg2) & FLAGS2_UNICODE_STRINGS) {
  				if (len > 2) {
  					len -= 2;
@@ -97,7 +106,7 @@
  			}
  			p += 2 + 24;
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE_ASCII);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE_ASCII);
  			SIVAL(q,0,len);
  			p += len;
  			len = PTR_DIFF(p, pdata);
@@ -106,7 +115,7 @@
  			SOFF_T(p,0,allocation_size); p += 8;
  			SIVAL(p,0,nt_extmode); p += 4;
 -			len = srvstr_push(outbuf, p + 4, fname, -1, STR_TERMINATE_ASCII);
-+			len = srvstr_push(outbuf, p + 4, fname, space_remaining - (p - pdata), STR_TERMINATE_ASCII);
++			len = srvstr_push(outbuf, p + 4, fname, PTR_DIFF(end_data, p+4), STR_TERMINATE_ASCII);
  			SIVAL(p,0,len);
  			p += 4 + len;
  			len = PTR_DIFF(p, pdata);
@@ -115,7 +124,7 @@
  				p +=4;
  			}
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE_ASCII);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE_ASCII);
  			SIVAL(q, 0, len);
  			p += len;
  
@@ -124,7 +133,7 @@
  			/* this must *not* be null terminated or w2k gets in a loop trying to set an
  			   acl on a dir (tridge) */
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE_ASCII);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE_ASCII);
  			SIVAL(p, -4, len);
  			p += len;
  			len = PTR_DIFF(p, pdata);
@@ -133,7 +142,7 @@
  			SIVAL(p,0,sbuf.st_dev); p += 4;
  			SIVAL(p,0,sbuf.st_ino); p += 4;
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE_ASCII);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE_ASCII);
  			SIVAL(q, 0, len);
  			p += len; 
  			len = PTR_DIFF(p, pdata);
@@ -142,7 +151,7 @@
  			SIVAL(p,0,sbuf.st_dev); p += 4;
  			SIVAL(p,0,sbuf.st_ino); p += 4;
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE_ASCII);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE_ASCII);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE_ASCII);
  			SIVAL(q,0,len);
  			p += len;
  			len = PTR_DIFF(p, pdata);
@@ -151,10 +160,60 @@
  			p+= 8;
  
 -			len = srvstr_push(outbuf, p, fname, -1, STR_TERMINATE);
-+			len = srvstr_push(outbuf, p, fname, space_remaining - (p - pdata), STR_TERMINATE);
++			len = srvstr_push(outbuf, p, fname, PTR_DIFF(end_data, p), STR_TERMINATE);
  			p += len;
  
  			len = PTR_DIFF(p, pdata);
+@@ -1318,6 +1318,7 @@
+ 		requested. */
+ 	char *params = *pparams;
+ 	char *pdata = *ppdata;
++	char *data_end;
+ 	int dirtype = SVAL(params,0);
+ 	int maxentries = SVAL(params,2);
+ 	uint16 findfirst_flags = SVAL(params,4);
+@@ -1409,6 +1410,7 @@
+ 
+ 	*ppdata = pdata;
+ 	memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
++	data_end = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
+ 
+ 	/* Realloc the params space */
+ 	params = SMB_REALLOC(*pparams, 10);
+@@ -1454,7 +1456,7 @@
+ 					inbuf, outbuf,
+ 					mask,dirtype,info_level,
+ 					requires_resume_key,dont_descend,
+-					&p,pdata,space_remaining, &out_of_space, &got_exact_match,
++					&p,pdata,data_end,space_remaining, &out_of_space, &got_exact_match,
+ 					&last_entry_off);
+ 		}
+ 
+@@ -1546,6 +1548,7 @@
+ 		requested. */
+ 	char *params = *pparams;
+ 	char *pdata = *ppdata;
++	char *data_end;
+ 	int dptr_num = SVAL(params,0);
+ 	int maxentries = SVAL(params,2);
+ 	uint16 info_level = SVAL(params,4);
+@@ -1621,6 +1624,7 @@
+ 
+ 	*ppdata = pdata;
+ 	memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
++	data_end = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
+ 
+ 	/* Realloc the params space */
+ 	params = SMB_REALLOC(*pparams, 6*SIZEOFWORD);
+@@ -1707,7 +1711,7 @@
+ 						inbuf, outbuf,
+ 						mask,dirtype,info_level,
+ 						requires_resume_key,dont_descend,
+-						&p,pdata,space_remaining, &out_of_space, &got_exact_match,
++						&p,pdata,data_end,space_remaining, &out_of_space, &got_exact_match,
+ 						&last_entry_off);
+ 		}
+ 
 @@ -1830,7 +1830,7 @@
  			 * the called hostname and the service name.
  			 */




More information about the Pkg-samba-maint mailing list