Changeset 578 for branches/samba-3.3.x/source/smbd

Timestamp:

Jun 25, 2011, 7:14:41 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.15 (security update)

Location:

branches/samba-3.3.x/source/smbd

Files:

• dnsregister.c (modified) (2 diffs)
• oplock.c (modified) (1 diff)
• oplock_irix.c (modified) (1 diff)
• process.c (modified) (1 diff)
• server.c (modified) (5 diffs)

branches/samba-3.3.x/source/smbd/dnsregister.c

@@ -126 +126 @@
         if (dns_state->srv_ref != NULL) {
                 mdnsd_conn_fd = DNSServiceRefSockFD(dns_state->srv_ref);
+                if (mdnsd_conn_fd < 0 || mdnsd_conn_fd >= FD_SETSIZE) {
+                        return;
+                }
                 FD_SET(mdnsd_conn_fd, listen_set);
                 return;
@@ -157 +160 @@
 
         mdnsd_conn_fd = DNSServiceRefSockFD(dns_state->srv_ref);
+        if (mdnsd_conn_fd < 0 || mdnsd_conn_fd >= FD_SETSIZE) {
+                return;
+        }
         FD_SET(mdnsd_conn_fd, listen_set);
         *maxfd = MAX(*maxfd, mdnsd_conn_fd);

branches/samba-3.3.x/source/smbd/oplock.c

@@ -242 +242 @@
 {
         if (koplocks) {
-                return koplocks->notification_fd;
+                int fd = koplocks->notification_fd;
+                if (fd < 0 || fd >= FD_SETSIZE) {
+                        return -1;
+                }
         }
 

branches/samba-3.3.x/source/smbd/oplock_irix.c

@@ -285 +285 @@
         }
 
+        if (pfd[0] < 0 || pfd[0] >= FD_SETSIZE) {
+                DEBUG(0,("setup_kernel_oplock_pipe: fd out of range.\n"));
+                return False;
+        }
+
         oplock_pipe_read = pfd[0];
         oplock_pipe_write = pfd[1];

branches/samba-3.3.x/source/smbd/process.c

@@ -699 +699 @@
 static int select_on_fd(int fd, int maxfd, fd_set *fds)
 {
-        if (fd != -1) {
+        if (fd != -1 && fd < FD_SETSIZE) {
                 FD_SET(fd, fds);
                 maxfd = MAX(maxfd, fd);

branches/samba-3.3.x/source/smbd/server.c

@@ -210 +210 @@
         /* We will abort gracefully when the client or remote system 
            goes away */
-        smbd_set_server_fd(dup(0));
+        int fd = dup(0);
+
+        if (fd < 0 || fd >= FD_SETSIZE) {
+                return false;
+        }
+
+        smbd_set_server_fd(fd);
         
         /* close our standard file descriptors */
@@ -437 +443 @@
                                                         ifss,
                                                         true);
-                                if(s == -1) {
+                                if(s < 0 || s >= FD_SETSIZE) {
+                                        close(s);
                                         continue;
                                 }
@@ -517 +524 @@
                                                 &ss,
                                                 true);
-                                if (s == -1) {
+                                if (s < 0 || s >= FD_SETSIZE) {
                                         continue;
                                 }
@@ -710 +717 @@
                         socklen_t in_addrlen = sizeof(addr);
                         pid_t child = 0;
+                        int fd;
 
                         s = -1;
@@ -722 +730 @@
                         }
 
-                        smbd_set_server_fd(accept(s,&addr,&in_addrlen));
-
-                        if (smbd_server_fd() == -1 && errno == EINTR)
+                        fd = accept(s,&addr,&in_addrlen);
+                        if (fd == -1 && errno == EINTR)
                                 continue;
-
-                        if (smbd_server_fd() == -1) {
+                        if (fd == -1) {
                                 DEBUG(2,("open_sockets_smbd: accept: %s\n",
                                          strerror(errno)));
                                 continue;
                         }
+                        if (fd < 0 || fd >= FD_SETSIZE) {
+                                DEBUG(2,("open_sockets_smbd: bad fd %d\n",
+                                        fd ));
+                                continue;
+                        }
+
+                        smbd_set_server_fd(fd);
 
                         /* Ensure child is set to blocking mode */