The branch, master has been updated via a77cffaa256 s4:torture: Initialize struct wrepl_wins_name via 909506c91c1 examples: Initialize char arrays via c814681c6b9 examples: Use cp with force option via 54ce370f7d0 s4:torture: Fully initialize struct samr_OpenUser via dd896862d0a s3:rpc_client: Check for array size instead of UINT16_MAX via 7990a2ba08c s4:torture: Initialize struct wrepl_wins_name via ec7dfedccf6 s3:auth: Avoid passing freed pamh pointer to funcitons using it via 990a68fedb9 s3:auth: Remove trailing spaces in pampass.c via 09d731470e1 s4:torture: Initialize struct smb2_handle via 4777464946c s4:torture: Initialize struct nbt_name_query via deced5eaae5 s3:torture: Remove trailing spaces in query.c from f824e985167 doc: Update codeing guidelines for struct initialisation
https://git.samba.org/?p=samba.git;a=shortlog;h=master - Log ----------------------------------------------------------------- commit a77cffaa256e6c4a6dbca115905c09ddbe9c22da Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 15:19:20 2024 +0200 s4:torture: Initialize struct wrepl_wins_name "Error: UNINIT (CWE-457): samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:1244: var_decl: Declaring variable ""wins_name1"" without initializer. samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:4835: assign: Assigning: ""wins_name_r1"" = ""&wins_name1"", which points to uninitialized data. samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:4905: uninit_use_in_call: Using uninitialized value ""*wins_name_r1"". Field ""wins_name_r1->is_group"" is uninitialized when calling ""test_wrepl_update_one"". 4903| 4904| /* now apply R1 */ 4905|-> ret &= test_wrepl_update_one(tctx, ctx, records[i].r1.owner, wins_name_r1); 4906| ret &= test_wrepl_is_applied(tctx, ctx, records[i].r1.owner, 4907| wins_name_r1, records[i].r1.apply_expected);" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> Autobuild-User(master): Andreas Schneider <a...@cryptomilk.org> Autobuild-Date(master): Fri Jun 28 12:44:31 UTC 2024 on atb-devel-224 commit 909506c91c1660f124d772b5caa0191f10ee320c Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 15:17:13 2024 +0200 examples: Initialize char arrays "Error: UNINIT (CWE-457): samba-4.20.0rc2/examples/libsmbclient/testacl3.c:15: var_decl: Declaring variable ""value"" without initializer. samba-4.20.0rc2/examples/libsmbclient/testacl3.c:55: uninit_use_in_call: Using uninitialized value ""*value"" as argument to ""%s"" when calling ""printf"". [Note: The source code implementation of the function has been overridden by a builtin model.] 53| } 54| 55|-> printf(""Attributes for [%s] are:\n%s\n"", path, value); 56| } 57|" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit c814681c6b965b15b3d4895cc0d47f01ba2c31d3 Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 15:14:43 2024 +0200 examples: Use cp with force option "Error: SHELLCHECK_WARNING: /usr/share/doc/samba/printing/VampireDriversFunctions:951:15: warning[SC2216]: Piping to 'cp', a command that doesn't read stdin. Wrong command or missing xargs? 949| CWD2=""$( pwd )"" ; 950| cd ""${i}""; 951|-> echo ""yes"" | cp ../alldriverfiles.txt . 2> /dev/null ; 952| 953| cat alldriverfiles.txt \" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit 54ce370f7d0ac0972f9693cef424c4239b15c754 Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 15:09:21 2024 +0200 s4:torture: Fully initialize struct samr_OpenUser "Error: UNINIT (CWE-457): samba-4.20.0rc2/source4/torture/rpc/samr.c:7381: var_decl: Declaring variable ""r"" without initializer. samba-4.20.0rc2/source4/torture/rpc/samr.c:7428: uninit_use: Using uninitialized value ""r.out.result.v"". 7426| torture_assert_ntstatus_ok(tctx, dcerpc_samr_QueryUserInfo_r(b, tctx, &q), 7427| ""QueryUserInfo failed""); 7428|-> if (!NT_STATUS_IS_OK(r.out.result)) { 7429| torture_result(tctx, TORTURE_FAIL, ""QueryUserInfo(%u) failed - %s\n"", r.in.rid, nt_errstr(r.out.result)); 7430| return false;" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit dd896862d0a430daa2f0c38325b6ef56dabe174e Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 13:38:34 2024 +0200 s3:rpc_client: Check for array size instead of UINT16_MAX mdscli_ctx->mdscmd_open.share_path is an array of size 1025. The boundary is 1025 and not UINT16_MAX. "Error: OVERRUN (CWE-119): samba-4.20.0rc2/source3/rpc_client/cli_mdssvc.c:127: cond_at_least: Checking ""share_path_len < 1UL"" implies that ""share_path_len"" is at least 1 on the false branch. samba-4.20.0rc2/source3/rpc_client/cli_mdssvc.c:127: cond_between: Checking ""share_path_len > 65535UL"" implies that ""share_path_len"" is between 1 and 65535 (inclusive) on the false branch. samba-4.20.0rc2/source3/rpc_client/cli_mdssvc.c:133: overrun-local: Overrunning array ""mdscli_ctx->mdscmd_open.share_path"" of 1025 bytes at byte offset 65534 using index ""share_path_len - 1UL"" (which evaluates to 65534). 131| mdscli_ctx->mdscmd_open.share_path_len = share_path_len; 132| 133|-> if (mdscli_ctx->mdscmd_open.share_path[share_path_len-1] == '/') { 134| mdscli_ctx->mdscmd_open.share_path[share_path_len-1] = '\0'; 135| mdscli_ctx->mdscmd_open.share_path_len--;" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit 7990a2ba08ca8ce015282aa01f318ae9623e51df Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 12:22:19 2024 +0200 s4:torture: Initialize struct wrepl_wins_name "Error: UNINIT (CWE-457): samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:6759: var_decl: Declaring variable ""wins_name_"" without initializer. samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:6760: assign: Assigning: ""wins_name"" = ""&wins_name_"", which points to uninitialized data. samba-4.20.0rc2/source4/torture/nbt/winsreplication.c:9455: uninit_use_in_call: Using uninitialized value ""*wins_name"". Field ""wins_name->is_group"" is uninitialized when calling ""test_wrepl_update_one"". 9453| wins_name->unknown = ""255.255.255.255""; 9454| 9455|-> ret &= test_wrepl_update_one(tctx, ctx, &ctx->b, wins_name); 9456| 9457| /*" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit ec7dfedccf6b30c69398b8473b503c7d19b132cf Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 10:20:51 2024 +0200 s3:auth: Avoid passing freed pamh pointer to funcitons using it "Error: USE_AFTER_FREE (CWE-416): samba-4.20.0rc2/source3/auth/pampass.c:466: freed_arg: ""pam_end"" frees ""pamh"". samba-4.20.0rc2/source3/auth/pampass.c:467: pass_freed_arg: Passing freed pointer ""pamh"" as an argument to ""smb_pam_error_handler"". 465| if( pamh != NULL ) { 466| pam_error = pam_end(pamh, 0); 467|-> if(smb_pam_error_handler(pamh, pam_error, ""End Cleanup Failed"", 2) == True) { 468| DEBUG(4, (""smb_pam_end: PAM: PAM_END OK.\n"")); 469| return True;" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit 990a68fedb9ac33de8b52b4091c6152c76fbbd7e Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 10:21:30 2024 +0200 s3:auth: Remove trailing spaces in pampass.c Reviewed-by: Noel Power <npo...@samba.org> commit 09d731470e1cb5e0ea24a0a3e3daaa869daf3c93 Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 10:11:31 2024 +0200 s4:torture: Initialize struct smb2_handle "Error: UNINIT (CWE-457): samba-4.20.0rc2/source4/torture/smb2/lease.c:336: var_decl: Declaring variable ""hnew"" without initializer. samba-4.20.0rc2/source4/torture/smb2/lease.c:377: uninit_use_in_call: Using uninitialized value ""hnew"" when calling ""smb2_util_close"". 375| done: 376| smb2_util_close(tree, h); 377|-> smb2_util_close(tree, hnew); 378| 379| smb2_util_unlink(tree, fname);" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit 4777464946c16fb9d731e45a9ddb23a34c89d898 Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 10:09:43 2024 +0200 s4:torture: Initialize struct nbt_name_query "Error: UNINIT (CWE-457): samba-4.20.0rc2/source4/torture/nbt/query.c:53: var_decl: Declaring variable ""io"" without initializer. samba-4.20.0rc2/source4/torture/nbt/query.c:76: uninit_use_in_call: Using uninitialized value ""io.in.retries"" when calling ""nbt_name_query_send"". 74| while (num_sent - (result->num_pass+result->num_fail) < 10) { 75| struct nbt_name_request *req; 76|-> req = nbt_name_query_send(nbtsock, &io); 77| torture_assert(tctx, req != NULL, ""Failed to setup request!""); 78| req->async.fn = increment_handler;" Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> commit deced5eaae54cb9d8fbbd7598be1550e4946a3a0 Author: Andreas Schneider <a...@samba.org> Date: Mon Jun 24 10:09:24 2024 +0200 s3:torture: Remove trailing spaces in query.c Signed-off-by: Andreas Schneider <a...@samba.org> Reviewed-by: Noel Power <npo...@samba.org> ----------------------------------------------------------------------- Summary of changes: examples/libsmbclient/testacl3.c | 4 ++-- examples/printing/VampireDriversFunctions | 6 +++--- source3/auth/pampass.c | 28 ++++++++++++++++------------ source3/rpc_client/cli_mdssvc.c | 4 +++- source4/torture/nbt/query.c | 18 +++++++++++------- source4/torture/nbt/winsreplication.c | 12 +++++++++--- source4/torture/rpc/samr.c | 10 +++++++--- source4/torture/smb2/lease.c | 7 ++++++- 8 files changed, 57 insertions(+), 32 deletions(-) Changeset truncated at 500 lines: diff --git a/examples/libsmbclient/testacl3.c b/examples/libsmbclient/testacl3.c index e5ec2c88b95..2e3ee5d4c3c 100644 --- a/examples/libsmbclient/testacl3.c +++ b/examples/libsmbclient/testacl3.c @@ -12,8 +12,8 @@ int main(int argc, char * argv[]) { int ret; int debug = 0; - char value[2048]; - char path[2048]; + char value[2048] = {}; + char path[2048] = {}; char * the_acl; char * p; SMBCCTX * context; diff --git a/examples/printing/VampireDriversFunctions b/examples/printing/VampireDriversFunctions index b06e3653214..6580f0a2dc6 100644 --- a/examples/printing/VampireDriversFunctions +++ b/examples/printing/VampireDriversFunctions @@ -948,7 +948,7 @@ else for i in */; do CWD2="$( pwd )" ; cd "${i}"; - echo "yes" | cp ../alldriverfiles.txt . 2> /dev/null ; + cp -f ../alldriverfiles.txt . 2> /dev/null ; cat alldriverfiles.txt \ | egrep '(\\'"$(basename "$( pwd )")"'\\|Driver Name)' \ @@ -1076,7 +1076,7 @@ else echo " " echo " ###########################################################################################" -###### echo "yes" | cp -f ../../../${nthost}/W32X86/${nthost}-enumdrivers3list-NTx86.txt . 2> /dev/null ; +###### cp -f ../../../${nthost}/W32X86/${nthost}-enumdrivers3list-NTx86.txt . 2> /dev/null ; ln -s -f ../${nthost}-enumdrivers3list-NTx86.txt ${nthost}-enumdrivers3list-NTx86.lnk ; tac ${nthost}-enumdrivers3list-NTx86.lnk \ @@ -1095,7 +1095,7 @@ else for i in */; do CWD2="$( pwd )" ; cd "${i}"; - echo "yes" | cp ../alldriverfiles.txt . 2> /dev/null ; + cp -f ../alldriverfiles.txt . 2> /dev/null ; cat alldriverfiles.txt \ | egrep '(\\'"$(basename "$( pwd )")"'\\|Driver Name)' \ diff --git a/source3/auth/pampass.c b/source3/auth/pampass.c index d64a6e83335..3e764f32f7d 100644 --- a/source3/auth/pampass.c +++ b/source3/auth/pampass.c @@ -1,4 +1,4 @@ -/* +/* Unix SMB/CIFS implementation. PAM Password checking Copyright (C) Andrew Tridgell 1992-2001 @@ -37,7 +37,7 @@ #ifdef WITH_PAM /******************************************************************* - * Handle PAM authentication + * Handle PAM authentication * - Access, Authentication, Session, Password * Note: See PAM Documentation and refer to local system PAM implementation * which determines what actions/limitations/allowances become affected. @@ -99,7 +99,7 @@ static bool smb_pam_error_handler(pam_handle_t *pamh, int pam_error, const char *********************************************************************/ static bool smb_pam_nt_status_error_handler(pam_handle_t *pamh, int pam_error, - const char *msg, int dbglvl, + const char *msg, int dbglvl, NTSTATUS *nt_status) { *nt_status = pam_to_nt_status(pam_error); @@ -220,7 +220,7 @@ struct chat_struct { Create a linked list containing chat data. ***************************************************************/ -static struct chat_struct *make_pw_chat(const char *p) +static struct chat_struct *make_pw_chat(const char *p) { char *prompt; char *reply; @@ -294,7 +294,7 @@ static int smb_pam_passchange_conv(int num_msg, struct chat_struct *t; const struct loadparm_substitution *lp_sub = loadparm_s3_global_substitution(); - bool found; + bool found; *resp = NULL; DEBUG(10,("smb_pam_passchange_conv: starting conversation for %d messages\n", num_msg)); @@ -452,7 +452,7 @@ static struct pam_conv *smb_setup_pam_conv(smb_pam_conv_fn smb_pam_conv_fnptr, c return pconv; } -/* +/* * PAM Closing out cleanup handler */ @@ -464,12 +464,16 @@ static bool smb_pam_end(pam_handle_t *pamh, struct pam_conv *smb_pam_conv_ptr) if( pamh != NULL ) { pam_error = pam_end(pamh, 0); - if(smb_pam_error_handler(pamh, pam_error, "End Cleanup Failed", 2) == True) { - DEBUG(4, ("smb_pam_end: PAM: PAM_END OK.\n")); + if (pam_error == PAM_SUCCESS) { + DBG_NOTICE("PAM: PAM_END OK.\n"); return True; } + + DBG_WARNING("PAM: PAM_END FAILED (%d).\n", pam_error); + } else { + DBG_INFO("PAM: not initialised\n"); } - DEBUG(2,("smb_pam_end: PAM: not initialised\n")); + return False; } @@ -559,7 +563,7 @@ static NTSTATUS smb_pam_auth(pam_handle_t *pamh, const char *user) return nt_status; } -/* +/* * PAM Account Handler */ static NTSTATUS smb_pam_account(pam_handle_t *pamh, const char * user) @@ -612,7 +616,7 @@ static NTSTATUS smb_pam_setcred(pam_handle_t *pamh, const char * user) */ DEBUG(4,("PAM: Account Management SetCredentials for User: %s\n", user)); - pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT)); + pam_error = pam_setcred(pamh, (PAM_ESTABLISH_CRED|PAM_SILENT)); switch( pam_error ) { case PAM_CRED_UNAVAIL: DEBUG(0, ("smb_pam_setcred: PAM: Credentials not found for user:%s\n", user )); @@ -710,7 +714,7 @@ static bool smb_pam_chauthtok(pam_handle_t *pamh, const char * user) default: DEBUG(0, ("PAM: UNKNOWN PAM ERROR (%d) for User: %s\n", pam_error, user)); } - + if(!smb_pam_error_handler(pamh, pam_error, "Password Change Failed", 2)) { return False; } diff --git a/source3/rpc_client/cli_mdssvc.c b/source3/rpc_client/cli_mdssvc.c index 93e032faa98..8678b4bbcb0 100644 --- a/source3/rpc_client/cli_mdssvc.c +++ b/source3/rpc_client/cli_mdssvc.c @@ -124,7 +124,9 @@ static void mdscli_connect_open_done(struct tevent_req *subreq) } share_path_len = strlen(mdscli_ctx->mdscmd_open.share_path); - if (share_path_len < 1 || share_path_len > UINT16_MAX) { + if (share_path_len < 1 || + share_path_len >= sizeof(mdscli_ctx->mdscmd_open.share_path)) + { tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR); return; } diff --git a/source4/torture/nbt/query.c b/source4/torture/nbt/query.c index 001ff19413b..6bdff3448cc 100644 --- a/source4/torture/nbt/query.c +++ b/source4/torture/nbt/query.c @@ -1,20 +1,20 @@ -/* +/* Unix SMB/CIFS implementation. NBT name query testing Copyright (C) Andrew Tridgell 2005 - + This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. - + This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - + You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>. */ @@ -50,7 +50,11 @@ static bool bench_namequery(struct torture_context *tctx) struct nbt_name_socket *nbtsock = torture_init_nbt_socket(tctx); int num_sent=0; struct result_struct *result; - struct nbt_name_query io; + struct nbt_name_query io = { + .in = { + .retries = 0, + } + }; struct timeval tv = timeval_current(); int timelimit = torture_setting_int(tctx, "timelimit", 5); @@ -80,7 +84,7 @@ static bool bench_namequery(struct torture_context *tctx) num_sent++; if (num_sent % 1000 == 0) { if (torture_setting_bool(tctx, "progress", true)) { - torture_comment(tctx, "%.1f queries per second (%d failures) \r", + torture_comment(tctx, "%.1f queries per second (%d failures) \r", result->num_pass / timeval_elapsed(&tv), result->num_fail); fflush(stdout); @@ -95,7 +99,7 @@ static bool bench_namequery(struct torture_context *tctx) tevent_loop_once(nbtsock->event_ctx); } - torture_comment(tctx, "%.1f queries per second (%d failures) \n", + torture_comment(tctx, "%.1f queries per second (%d failures) \n", result->num_pass / timeval_elapsed(&tv), result->num_fail); diff --git a/source4/torture/nbt/winsreplication.c b/source4/torture/nbt/winsreplication.c index 90004cabe63..77bef8c81e1 100644 --- a/source4/torture/nbt/winsreplication.c +++ b/source4/torture/nbt/winsreplication.c @@ -1241,8 +1241,12 @@ static bool test_conflict_different_owner(struct torture_context *tctx, struct test_wrepl_conflict_conn *ctx) { bool ret = true; - struct wrepl_wins_name wins_name1; - struct wrepl_wins_name wins_name2; + struct wrepl_wins_name wins_name1 = { + .flags = 0, + }; + struct wrepl_wins_name wins_name2 = { + .flags = 0, + }; struct wrepl_wins_name *wins_name_r1; struct wrepl_wins_name *wins_name_r2; uint32_t i; @@ -6758,7 +6762,9 @@ static bool test_conflict_owned_active_vs_replica(struct torture_context *tctx, { bool ret = true; NTSTATUS status; - struct wrepl_wins_name wins_name_; + struct wrepl_wins_name wins_name_ = { + .flags = 0, + }; struct wrepl_wins_name *wins_name = &wins_name_; struct nbt_name_register name_register_; struct nbt_name_register *name_register = &name_register_; diff --git a/source4/torture/rpc/samr.c b/source4/torture/rpc/samr.c index 22e0606de96..b7d0b2c72cf 100644 --- a/source4/torture/rpc/samr.c +++ b/source4/torture/rpc/samr.c @@ -7378,13 +7378,17 @@ static bool test_each_DisplayInfo_user(struct dcerpc_binding_handle *b, struct samr_QueryDisplayInfo *querydisplayinfo, bool *seen_testuser) { - struct samr_OpenUser r; + struct samr_OpenUser r = { + .in = { + .domain_handle = querydisplayinfo->in.domain_handle, + .access_mask = SEC_FLAG_MAXIMUM_ALLOWED, + }, + }; struct samr_QueryUserInfo q; union samr_UserInfo *info; struct policy_handle user_handle; int i, ret = true; - r.in.domain_handle = querydisplayinfo->in.domain_handle; - r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED; + for (i = 0; ; i++) { switch (querydisplayinfo->in.level) { case 1: diff --git a/source4/torture/smb2/lease.c b/source4/torture/smb2/lease.c index 30bbefdce6a..60c79e7666b 100644 --- a/source4/torture/smb2/lease.c +++ b/source4/torture/smb2/lease.c @@ -333,7 +333,12 @@ static bool test_lease_upgrade2(struct torture_context *tctx, struct smb2_tree *tree) { TALLOC_CTX *mem_ctx = talloc_new(tctx); - struct smb2_handle h, hnew; + struct smb2_handle h = { + .data = {}, + }; + struct smb2_handle hnew = { + .data = {}, + }; NTSTATUS status; struct smb2_create io; struct smb2_lease ls; -- Samba Shared Repository