libsmb2-6.3

libsmb2 6.3 is a security release on top of 6.2. It contains only fixes for
crashes and memory errors that a malformed or hostile server reply (or, for
smb2_server, a hostile client request) can trigger. The API and ABI are
unchanged from 6.2 and the soname is the same, so it is a drop-in update.

Current master has API changes that are not released yet; 6.3 comes from the
libsmb2-6-branch maintenance branch.

Fixes

• Heap out-of-bounds read of the file name in smb2_decode_file_all_info() (#457).
• Validate untrusted lengths and offsets throughout the PDU decoders: session
  packet length and SMB3 transform header, NTLMSSP and SPNEGO/BER blobs,
  IOCTL output copy, negotiate contexts, session setup, error replies, reparse
  points and security descriptors. Also fixes a double free in the
  QUERY_DIRECTORY reply error paths.
• Stack out-of-bounds read in smb2_read_data() on a header-only interim reply.
• NULL dereference in stat/fstat/statvfs when a QUERY_INFO reply reports
  success but carries no data. These calls now fail with EIO.
• Integer overflows in the DCE/RPC conformant string and array decoders,
  reachable from smb2_share_enum_async() (#496).
• UBSan: memcpy() from a NULL buffer in the NTLMSSP encoder on every
  session setup.

Thanks to Yuanfu Xie, HaiND and tonghuaroot for the reports.