Skip to content

Commit

Permalink
net/samba416: Patch to prevent abnormal smbd abort
Browse files Browse the repository at this point in the history
Update a call to memcpy() because readdir() only guarantees memory up to
result+result->d_reclen is readable.  Under certain conditions,
result+sizeof(struct dirent) landed in unmapped memory.

Most of the legwork to pinpoint the problem, as well as a solution
similar to the one applied here, was submitted by uratan@miomio.jp.
Martin Simmons <martin@lispworks.com> contributed to understanding the
problem and wrote a useful test case.

PR:		275597
Approved by:	maintainer timeout
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D43171
  • Loading branch information
Jehops committed Feb 11, 2024
1 parent 4d161ff commit 3fb51f8
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 1 deletion.
2 changes: 1 addition & 1 deletion net/samba416/Makefile
@@ -1,6 +1,6 @@
PORTNAME= ${SAMBA4_BASENAME}416
PORTVERSION= ${SAMBA4_VERSION}
PORTREVISION= 3
PORTREVISION= 4
CATEGORIES?= net
MASTER_SITES= SAMBA/samba/stable SAMBA/samba/rc
DISTNAME= ${SAMBA4_DISTNAME}
Expand Down
14 changes: 14 additions & 0 deletions net/samba416/files/patch-source3_modules_vfs__cap.c
@@ -0,0 +1,14 @@
--- source3/modules/vfs_cap.c.orig 2022-01-24 10:26:59 UTC
+++ source3/modules/vfs_cap.c
@@ -112,7 +112,10 @@ static struct dirent *cap_readdir(vfs_handle_struct *h
return NULL;
}
talloc_set_name_const(newdirent, "struct dirent");
- memcpy(newdirent, result, sizeof(struct dirent));
+ /* See FreeBSD bug #275597 for an explanation of this patch. */
+ /* memcpy(newdirent, result, sizeof(struct dirent)); */
+ memcpy(newdirent, result, result->d_reclen);
+ /*******************************************************************/
memcpy(&newdirent->d_name, newname, newnamelen);
return newdirent;
}

0 comments on commit 3fb51f8

Please sign in to comment.