Changeset 587 for vendor/current/source3/utils

Timestamp:

Jun 29, 2011, 7:36:41 AM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Samba 3.5: Update vendor to version 3.5.6

Location:

vendor/current/source3/utils

Files:

• net_ads.c (modified) (2 diffs)
• net_rpc_printer.c (modified) (4 diffs)
• net_rpc_registry.c (modified) (1 diff)
• profiles.c (modified) (1 diff)
• smbfilter.c (modified) (4 diffs)

vendor/current/source3/utils/net_ads.c

@@ -542 +542 @@
         DOM_SID primary_group_sid;
         uint32_t group_rid;
-        enum SID_NAME_USE type;
+        enum wbcSidType type;
 
         if (argc < 1 || c->display_usage) {
@@ -597 +597 @@
                                   NULL, /* don't look up domain */
                                   &primary_group,
-                                  (enum wbcSidType *) &type);
+                                  &type);
         if (!WBC_ERROR_IS_OK(wbc_status)) {
                 d_fprintf(stderr, "wbcLookupSid: %s\n",

vendor/current/source3/utils/net_rpc_printer.c

@@ -755 +755 @@
         NTSTATUS status;
         struct spoolss_SetPrinterInfoCtr info_ctr;
+        struct spoolss_SetPrinterInfo2 info2;
         struct spoolss_DevmodeContainer devmode_ctr;
         struct sec_desc_buf secdesc_ctr;
@@ -774 +775 @@
                 break;
         case 2:
-                info_ctr.info.info2 = (struct spoolss_SetPrinterInfo2 *)
-                        (void *)&info->info2;
+                spoolss_printerinfo2_to_setprinterinfo2(&info->info2, &info2);
+                info_ctr.info.info2 = &info2;
                 break;
         case 3:
@@ -2045 +2046 @@
         for (i = 0; i < num_printers; i++) {
 
+                struct spoolss_SetPrinterInfo2 info2;
+
                 /* do some initialization */
                 printername = info_enum[i].info2.printername;
@@ -2096 +2099 @@
 
                 info_ctr.level = level;
-                info_ctr.info.info2 = (struct spoolss_SetPrinterInfo2 *)
-                        (void *)&info_src.info2;
+                spoolss_printerinfo2_to_setprinterinfo2(&info_src.info2, &info2);
+                info_ctr.info.info2 = &info2;
 
                 result = rpccli_spoolss_addprinterex(pipe_hnd_dst,

vendor/current/source3/utils/net_rpc_registry.c

@@ -1151 +1151 @@
 
         d_printf(_("Opening %s...."), argv[1]);
-        if ( !(outfile = regfio_open( argv[1], (O_RDWR|O_CREAT|O_TRUNC), (S_IREAD|S_IWRITE) )) ) {
+        if ( !(outfile = regfio_open( argv[1], (O_RDWR|O_CREAT|O_TRUNC),
+                                      (S_IRUSR|S_IWUSR) )) ) {
                 d_fprintf(stderr, _("Failed to open %s for writing\n"),argv[1]);
                 goto out;

vendor/current/source3/utils/profiles.c

@@ -276 +276 @@
         }
 
-        if ( !(outfile = regfio_open( new_filename, (O_RDWR|O_CREAT|O_TRUNC), (S_IREAD|S_IWRITE) )) ) {
+        if ( !(outfile = regfio_open( new_filename, (O_RDWR|O_CREAT|O_TRUNC),
+                                      (S_IRUSR|S_IWUSR) )) ) {
                 fprintf( stderr, "Failed to open new file %s!\n", new_filename );
                 fprintf( stderr, "Error was (%s)\n", strerror(errno) );

vendor/current/source3/utils/smbfilter.c

@@ -75 +75 @@
 }
 
-static void filter_request(char *buf)
+static void filter_request(char *buf, size_t buf_len)
 {
         int msg_type = CVAL(buf,0);
         int type = CVAL(buf,smb_com);
+        unsigned x;
         fstring name1,name2;
-        unsigned x;
+        int name_len1, name_len2;
+        int name_type1, name_type2;
 
         if (msg_type) {
                 /* it's a netbios special */
-                switch (msg_type) {
+                switch (msg_type)
                 case 0x81:
                         /* session request */
-                        name_extract(buf,4,name1);
-                        name_extract(buf,4 + name_len(buf + 4),name2);
+                        /* inbuf_size is guaranteed to be at least 4. */
+                        name_len1 = name_len((unsigned char *)(buf+4),
+                                        buf_len - 4);
+                        if (name_len1 <= 0 || name_len1 > buf_len - 4) {
+                                DEBUG(0,("Invalid name length in session request\n"));
+                                return;
+                        }
+                        name_len2 = name_len((unsigned char *)(buf+4+name_len1),
+                                        buf_len - 4 - name_len1);
+                        if (name_len2 <= 0 || name_len2 > buf_len - 4 - name_len1) {
+                                DEBUG(0,("Invalid name length in session request\n"));
+                                return;
+                        }
+
+                        name_type1 = name_extract((unsigned char *)buf,
+                                        buf_len,(unsigned int)4,name1);
+                        name_type2 = name_extract((unsigned char *)buf,
+                                        buf_len,(unsigned int)(4 + name_len1),name2);
+
+                        if (name_type1 == -1 || name_type2 == -1) {
+                                DEBUG(0,("Invalid name type in session request\n"));
+                                return;
+                        }
+
                         d_printf("sesion_request: %s -> %s\n",
                                  name1, name2);
@@ -98 +122 @@
                                          * name */
                                         memcpy(buf+4, mangled,
-                                               name_len(mangled));
+                                               name_len((unsigned char *)mangled,
+                                                        talloc_get_size(mangled)));
                                         TALLOC_FREE(mangled);
                                 }
                         }
-                }
                 return;
         }
@@ -119 +143 @@
                 break;
         }
-
 }
 
@@ -185 +208 @@
                                 exit(0);
                         }
-                        filter_request(packet);
+                        filter_request(packet, len);
                         if (!send_smb(s, packet)) {
                                 d_printf("server is dead\n");