Changeset 920 for trunk/server/source3/smbd

Timestamp:

Jun 9, 2016, 2:23:12 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to trunk

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/smbd/conn.c (modified) (1 diff)
• source3/smbd/dir.c (modified) (1 diff)
• source3/smbd/files.c (modified) (1 diff)
• source3/smbd/smb2_server.c (modified) (1 diff)
• source3/smbd/vfs.c (modified) (2 diffs)

trunk/server/source3/smbd/conn.c

@@ -24 +24 @@
 #include "smbd/globals.h"
 #include "rpc_server/rpc_ncacn_np.h"
+#include "lib/util/bitmap.h"
 
 /* The connections bitmap is expanded in increments of BITMAP_BLOCK_SZ. The

trunk/server/source3/smbd/dir.c

@@ -24 +24 @@
 #include "smbd/globals.h"
 #include "libcli/security/security.h"
+#include "lib/util/bitmap.h"
 
 /*

trunk/server/source3/smbd/files.c

@@ -23 +23 @@
 #include "libcli/security/security.h"
 #include "util_tdb.h"
+#include "lib/util/bitmap.h"
 
 #define VALID_FNUM(fnum)   (((fnum) >= 0) && ((fnum) < real_max_open_files))

trunk/server/source3/smbd/smb2_server.c

@@ -27 +27 @@
 #include "../lib/util/tevent_ntstatus.h"
 #include "smbprofile.h"
+#include "../lib/util/bitmap.h"
 
 #define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)

trunk/server/source3/smbd/vfs.c

@@ -991 +991 @@
                 const char *conn_rootdir;
                 size_t rootdir_len;
+                bool matched;
 
                 conn_rootdir = SMB_VFS_CONNECTPATH(conn, fname);
@@ -1001 +1002 @@
 
                 rootdir_len = strlen(conn_rootdir);
-                if (strncmp(conn_rootdir, resolved_name,
-                                rootdir_len) != 0) {
+                matched = (strncmp(conn_rootdir, resolved_name,
+                                rootdir_len) == 0);
+                if (!matched || (resolved_name[rootdir_len] != '/' &&
+                                 resolved_name[rootdir_len] != '\0')) {
                         DEBUG(2, ("check_reduced_name: Bad access "
                                 "attempt: %s is a symlink outside the "