[SCM] Samba Shared Repository - branch master updated

[Jeremy Allison]

The branch, master has been updated
       via  04e4346 s3: smbd - smb1 - fix read of deleted memory in 
reply_writeclose().
      from  bbd0bda smbd: Fix an uninitialized memory read

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master


- Log -----------------------------------------------------------------
commit 04e434661fa6b5f13776f925b0a7cbadb6b6d006
Author: Noel Power <nopo...@suse.com>
Date:   Thu Feb 27 12:07:11 2014 -0800

    s3: smbd - smb1 - fix read of deleted memory in reply_writeclose().
    
    While running smbtorture test raw.write under valgrind an "Invalid read"
    was reported in methid reply_writeclose, it seems after closing a file
    sometime later we try to access it again.
    
    Signed-off-by: Noel Power <noel.po...@suse.com>
    Signed-off-by: Jeremy Allison <j...@samba.org>
    Reviewed-by: Andreas Schneider <a...@samba.org>
    
    Autobuild-User(master): Jeremy Allison <j...@samba.org>
    Autobuild-Date(master): Mon Mar  3 20:42:40 CET 2014 on sn-devel-104

-----------------------------------------------------------------------

Summary of changes:
 source3/smbd/reply.c |   24 +++++++++++++-----------
 1 files changed, 13 insertions(+), 11 deletions(-)


Changeset truncated at 500 lines:

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 6b56239..3f3bbe1 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -5184,7 +5184,7 @@ void reply_writeclose(struct smb_request *req)
        mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
        data = (const char *)req->buf + 1;
 
-       if (!fsp->print_file) {
+       if (fsp->print_file == NULL) {
                init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
                    (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
                    &lock);
@@ -5198,6 +5198,10 @@ void reply_writeclose(struct smb_request *req)
 
        nwritten = write_file(req,fsp,data,startpos,numtowrite);
 
+       if (fsp->print_file == NULL) {
+               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
+       }
+
        set_close_write_time(fsp, mtime);
 
        /*
@@ -5205,34 +5209,32 @@ void reply_writeclose(struct smb_request *req)
         * JRA.
         */
 
+       DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
+               fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
+               (numtowrite) ? conn->num_files_open - 1 : 
conn->num_files_open));
+
        if (numtowrite) {
                DEBUG(3,("reply_writeclose: zero length write doesn't close "
                         "file %s\n", fsp_str_dbg(fsp)));
                close_status = close_file(req, fsp, NORMAL_CLOSE);
+               fsp = NULL;
        }
 
-       DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
-                fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
-                conn->num_files_open));
-
        if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
                reply_nterror(req, NT_STATUS_DISK_FULL);
-               goto strict_unlock;
+               goto out;
        }
 
        if(!NT_STATUS_IS_OK(close_status)) {
                reply_nterror(req, close_status);
-               goto strict_unlock;
+               goto out;
        }
 
        reply_outbuf(req, 1, 0);
 
        SSVAL(req->outbuf,smb_vwv0,nwritten);
 
-strict_unlock:
-       if (numtowrite && !fsp->print_file) {
-               SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
-       }
+out:
 
        END_PROFILE(SMBwriteclose);
        return;


-- 
Samba Shared Repository