subject:"\[SCM\] Samba Shared Repository \- branch v3\-4\-stable updated"

[SCM] Samba Shared Repository - branch v3-4-stable updated

2012-04-10 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  9123504 rerun 'make samba3-idl'
   via  afaa5f6 pidl/NDR/Parser: also do range checks on the array size
   via  04355f6 pidl/NDR/Parser: do array range validation in 
ParseArrayPullGetLength()
   via  d84758a pidl/NDR/Parser: use helper variables for array size and 
length
   via  3e89dbf pidl/NDR/Parser: remember if we already know the array 
length
   via  586c3fa pidl/NDR/Parser: use ParseArrayPullGetLength() to get the 
number of array elements (bug #8815 / CVE-2012-1182)
   via  eb8240e pidl/NDR/Parser: split off ParseArrayPullGetSize() and 
ParseArrayPullGetLength()
   via  102e995 pidl/NDR/Parser: simplify logic in DeclareArrayVariables*()
   via  45245f1 pidl/NDR/Parser: declare all union helper variables in 
ParseUnionPull()
   via  b48e41c pidl:NDR/Parser: fix range() for arrays
   via  dd5faa1 pidl: allow foo being on the wire after [length_is(foo)] 
uint8 *buffer
   via  75aeb61 pidl: add support for [string] on fixed size arrays.
   via  0cc91c9 WHATSNEW: Prepare release notes for 3.4.16.
  from  fcd2aeb WHATSNEW: Start release notes for 3.4.16.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 9123504f2b6f9af458510721416cb25993959a31
Author: Stefan Metzmacher 
Date:   Thu Mar 15 18:51:29 2012 +0100

rerun 'make samba3-idl'

metze

The last 12 patches address bug #8815 (PIDL based autogenerated code allows
overwriting beyond of allocated array; CVE-2012-1182).

commit afaa5f66a8686d5f4e371b66e846249a30e1495f
Author: Stefan Metzmacher 
Date:   Thu Mar 15 17:03:05 2012 +0100

pidl/NDR/Parser: also do range checks on the array size

metze

commit 04355f68753aeb85655b7cbd8677899db0c97764
Author: Stefan Metzmacher 
Date:   Thu Mar 15 13:14:48 2012 +0100

pidl/NDR/Parser: do array range validation in ParseArrayPullGetLength()

metze

commit d84758a5c8ce428ac5a3a8cb2e5b8a0e0662ac27
Author: Stefan Metzmacher 
Date:   Thu Mar 15 13:13:20 2012 +0100

pidl/NDR/Parser: use helper variables for array size and length

metze

commit 3e89dbfa0dd0c8cd4bcec8ea868a401f9b132aa3
Author: Stefan Metzmacher 
Date:   Thu Mar 15 15:07:08 2012 +0100

pidl/NDR/Parser: remember if we already know the array length

metze

commit 586c3fab85cde3bd6a5141fbba3bb5fcb6b67ab5
Author: Stefan Metzmacher 
Date:   Thu Mar 15 13:07:47 2012 +0100

pidl/NDR/Parser: use ParseArrayPullGetLength() to get the number of array 
elements (bug #8815 / CVE-2012-1182)

An anonymous researcher and Brian Gorenc (HP DVLabs) working
with HP's Zero Day Initiative program have found this and notified us.

metze

commit eb8240ecb0d82a8f9b3b7c7d317c57f1aff74296
Author: Stefan Metzmacher 
Date:   Thu Mar 15 13:05:39 2012 +0100

pidl/NDR/Parser: split off ParseArrayPullGetSize() and 
ParseArrayPullGetLength()

metze

commit 102e9956316ac2b440bb75eb039b184a2886
Author: Stefan Metzmacher 
Date:   Thu Mar 15 13:12:04 2012 +0100

pidl/NDR/Parser: simplify logic in DeclareArrayVariables*()

metze

commit 45245f10c3bd476bcb49be25bc56bb7811b85d3c
Author: Stefan Metzmacher 
Date:   Thu Mar 15 13:09:51 2012 +0100

pidl/NDR/Parser: declare all union helper variables in ParseUnionPull()

metze

commit b48e41cb5541bec34333f94fc21bcd6c47018869
Author: Stefan Metzmacher 
Date:   Tue Sep 21 05:41:37 2010 +0200

pidl:NDR/Parser: fix range() for arrays

metze
(cherry picked from commit bea4948acb4bbee2fbf886adeb53edbc84de96da)

commit dd5faa13873fbdd92fa4ddd82dc69d34a73e4d1f
Author: Stefan Metzmacher 
Date:   Mon Jul 27 17:34:37 2009 +0200

pidl: allow foo being on the wire after [length_is(foo)] uint8 *buffer

metze
(cherry picked from commit 92791ce9a8439ac06a22afdbeb0d0fc66c32cb31)

commit 75aeb61c38efe28503991834fb5181537cdffc68
Author: Stefan Metzmacher 
Date:   Mon Jul 27 15:52:16 2009 +0200

pidl: add support for [string] on fixed size arrays.

midl also supports this:

struct {
long l1;
[string] wchar_t str[16];
long l2;
};

Where the wire size of str is encoded like a length_is() header:
4-byte offset == 0;
4-byte array length;

The strings are zero terminated.

metze
(cherry picked from commit 7ccc9a6ef563cc855752b4e74152420b9be5af43)

commit 0cc91c98f6d311a92aa308e9fcbac252c96d590d
Author: Karolin Seeger 
Date:   Sat Apr 7 16:24:33 2012 +0200

WHATSNEW: Prepare release notes for 3.4.16.

Karolin

---

Summary of changes:
 WHATSNEW.txt |   14 +-
 librpc/gen_ndr/ndr_dfs.c |  840 
 librpc/gen_ndr/ndr_drsblobs.c|  156 ++-
 librpc/gen_ndr/ndr_drsuapi.c |  971

[SCM] Samba Shared Repository - branch v3-4-stable updated

2012-04-10 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  e93e5bd WHATSNEW: Fix typo.
   via  de125e2 WHATSNEW: Start release notes for Samba 3.4.17.
   via  5a68f1e8 VERSION: Bump version up to 3.4.17.
  from  9123504 rerun 'make samba3-idl'

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit e93e5bdb41fb28f1af5e3b072ddfd2552e58fd0c
Author: Karolin Seeger 
Date:   Tue Apr 10 20:33:06 2012 +0200

WHATSNEW: Fix typo.

Karolin

commit de125e2aef6f9b465736fa5c9fac6286d7ed6a16
Author: Karolin Seeger 
Date:   Tue Apr 10 20:32:16 2012 +0200

WHATSNEW: Start release notes for Samba 3.4.17.

Karolin

commit 5a68f1e8255318f3383b04ebc32ddd6e715cd54a
Author: Karolin Seeger 
Date:   Tue Apr 10 20:30:09 2012 +0200

VERSION: Bump version up to 3.4.17.

Karolin

---

Summary of changes:
 WHATSNEW.txt|   47 ---
 source3/VERSION |2 +-
 2 files changed, 45 insertions(+), 4 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index dd400e0..41685fc 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,6 +1,47 @@
==
+   Release Notes for Samba 3.4.17
+  , 2012
+   ==
+
+
+This is a security release in order to address
+CVE- ().
+
+o  
+
+Changes since 3.4.16
+
+
+
+o   Stefan Metzmacher 
+
+
+##
+Reporting bugs & Development Discussion
+###
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 3.4 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+==
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+==
+
+
+Release notes for older versions follow:
+
+
+   ==
Release Notes for Samba 3.4.16
-  April 10, 2011
+  April 10, 2012
==
 
 
@@ -42,8 +83,8 @@ database (https://bugzilla.samba.org/).
 ==
 
 
-Release notes for older versions follow:
-
+--
+
 
==
Release Notes for Samba 3.4.15
diff --git a/source3/VERSION b/source3/VERSION
index 756104f..5c569c6 100644
--- a/source3/VERSION
+++ b/source3/VERSION
@@ -25,7 +25,7 @@
 
 SAMBA_VERSION_MAJOR=3
 SAMBA_VERSION_MINOR=4
-SAMBA_VERSION_RELEASE=16
+SAMBA_VERSION_RELEASE=17
 
 
 # Bug fix releases use a letter for the patch revision #


-- 
Samba Shared Repository

[SCM] Samba Shared Repository - branch v3-4-stable updated

2012-04-30 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  55045f5 Fix self granting privileges in security=ads.
   via  a78242b WHATSNEW: Release notes 3.4.17.
  from  e93e5bd WHATSNEW: Fix typo.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 55045f52181e5448c2aeefabde047128158d7c2e
Author: Jeremy Allison 
Date:   Tue Apr 17 16:39:00 2012 -0700

Fix self granting privileges in security=ads.

CVE-2012-2111

commit a78242b544ab1a7b486856b87824050deca661dc
Author: Karolin Seeger 
Date:   Sat Apr 28 18:58:03 2012 +0200

WHATSNEW: Release notes 3.4.17.

Karolin

---

Summary of changes:
 WHATSNEW.txt|   15 ++---
 source3/rpc_server/srv_lsa_nt.c |   42 +++---
 2 files changed, 49 insertions(+), 8 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 41685fc..4495fb8 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,19 +1,26 @@
==
Release Notes for Samba 3.4.17
-  , 2012
+  April 30, 2012
==
 
 
 This is a security release in order to address
-CVE- ().
+CVE-2012-2111 (Incorrect permission checks when granting/removing
+privileges can compromise file server security).
+
+o  CVE-2012-2111:
+   Samba 3.4.x to 3.6.4 are affected by a
+   vulnerability that allows arbitrary users
+   to modify privileges on a file server.
 
-o  
 
 Changes since 3.4.16
 
 
 
-o   Stefan Metzmacher 
+o   Jeremy Allison 
+* Fix  incorrect permission checks when granting/removing
+  privileges (CVE-2012-2111).
 
 
 ##
diff --git a/source3/rpc_server/srv_lsa_nt.c b/source3/rpc_server/srv_lsa_nt.c
index f187432..a405dd2 100644
--- a/source3/rpc_server/srv_lsa_nt.c
+++ b/source3/rpc_server/srv_lsa_nt.c
@@ -1579,6 +1579,15 @@ NTSTATUS _lsa_CreateAccount(pipes_struct *p,
 {
struct lsa_info *handle;
struct lsa_info *info;
+   uint32 des_access = r->in.access_mask;
+   uint32 acc_granted;
+   uint32 owner_access = (LSA_ACCOUNT_ALL_ACCESS &
+   ~(LSA_ACCOUNT_ADJUST_PRIVILEGES|
+   LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
+   DELETE_ACCESS));
+   SEC_DESC *psd = NULL;
+   size_t sd_size;
+   NTSTATUS status;
 
/* find the connection policy handle. */
if (!find_policy_by_hnd(p, r->in.handle, (void **)(void *)&handle))
@@ -1600,6 +1609,27 @@ NTSTATUS _lsa_CreateAccount(pipes_struct *p,
if ( is_privileged_sid( r->in.sid ) )
return NT_STATUS_OBJECT_NAME_COLLISION;
 
+   /* Work out max allowed. */
+   map_max_allowed_access(p->server_info->ptok, &des_access);
+
+   /* map the generic bits to the lsa policy ones */
+   se_map_generic(&des_access, &lsa_policy_mapping);
+
+   /* get the generic lsa policy SD until we store it */
+   status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size, 
&lsa_policy_mapping,
+   r->in.sid, owner_access);
+   if (!NT_STATUS_IS_OK(status)) {
+   return status;
+   }
+
+   status = access_check_object(psd, p->server_info->ptok,
+   NULL, 0, des_access,
+   &acc_granted, "_lsa_CreateAccont" );
+
+   if (!NT_STATUS_IS_OK(status)) {
+   return status;
+   }
+
/* associate the user/group SID with the (unique) handle. */
 
info = TALLOC_ZERO_P(p->mem_ctx, struct lsa_info);
@@ -1608,7 +1638,7 @@ NTSTATUS _lsa_CreateAccount(pipes_struct *p,
}
 
info->sid = *r->in.sid;
-   info->access = r->in.access_mask;
+   info->access = acc_granted;
info->type = LSA_HANDLE_ACCOUNT_TYPE;
 
/* get a (unique) handle.  open a policy on it. */
@@ -1631,6 +1661,10 @@ NTSTATUS _lsa_OpenAccount(pipes_struct *p,
size_t sd_size;
uint32_t des_access = r->in.access_mask;
uint32_t acc_granted;
+   uint32_t owner_access = (LSA_ACCOUNT_ALL_ACCESS &
+   ~(LSA_ACCOUNT_ADJUST_PRIVILEGES|
+   LSA_ACCOUNT_ADJUST_SYSTEM_ACCESS|
+   STD_RIGHT_DELETE_ACCESS));
NTSTATUS status;
 
/* find the connection policy handle. */
@@ -1653,7 +1687,7 @@ NTSTATUS _lsa_OpenAccount(pipes_struct *p,
/* get the generic lsa account SD until we store it */
status = make_lsa_object_sd(p->mem_ctx, &psd, &sd_size,
&lsa_account_mapping,
-   r->in.sid, LSA_ACCOUNT_ALL_ACCESS);
+   r->in.sid, owner_access);
if (!NT_STATUS_IS_OK(status))

[SCM] Samba Shared Repository - branch v3-4-stable updated

2012-04-30 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  4c0ff85 WHATSNEW: Start release notes for 3.4.18.
   via  195943b VERSION: Bump version number up to 3.4.18.
  from  55045f5 Fix self granting privileges in security=ads.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 4c0ff855799ffd2067768869f379d2d2e3d3b514
Author: Karolin Seeger 
Date:   Mon Apr 30 20:53:59 2012 +0200

WHATSNEW: Start release notes for 3.4.18.

Karolin

commit 195943b7bf95e4a85795f86dda0cf71170c7c2de
Author: Karolin Seeger 
Date:   Mon Apr 30 20:51:55 2012 +0200

VERSION: Bump version number up to 3.4.18.

Karolin

---

Summary of changes:
 WHATSNEW.txt|   46 --
 source3/VERSION |2 +-
 2 files changed, 45 insertions(+), 3 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 4495fb8..4283231 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,46 @@
==
+   Release Notes for Samba 3.4.18
+  , 2012
+   ==
+
+
+This is a security release in order to address
+CVE-2012- ().
+
+o  CVE-2012-:
+
+
+Changes since 3.4.17
+
+
+
+o   Jeremy Allison 
+
+
+##
+Reporting bugs & Development Discussion
+###
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 3.4 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+==
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+==
+
+
+Release notes for older versions follow:
+
+
+   ==
Release Notes for Samba 3.4.17
   April 30, 2012
==
@@ -43,8 +85,8 @@ database (https://bugzilla.samba.org/).
 ==
 
 
-Release notes for older versions follow:
-
+--
+
 
==
Release Notes for Samba 3.4.16
diff --git a/source3/VERSION b/source3/VERSION
index 5c569c6..7a625bf 100644
--- a/source3/VERSION
+++ b/source3/VERSION
@@ -25,7 +25,7 @@
 
 SAMBA_VERSION_MAJOR=3
 SAMBA_VERSION_MINOR=4
-SAMBA_VERSION_RELEASE=17
+SAMBA_VERSION_RELEASE=18
 
 
 # Bug fix releases use a letter for the patch revision #


-- 
Samba Shared Repository

[SCM] Samba Shared Repository - branch v3-4-stable updated

2009-10-22 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  470f322... WHATSNEW: Update changes since 3.4.2.
  from  1b5efd6... s3:docs: Add info about how to obtain cifs module in 
cifs mount helper manpage (cherry picked from commit 
a224392649ffb81dc1d67f41a01dd983b76d513b)

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 470f32243f0f02d3b1078f6ffeb126bdbda7b05d
Author: Karolin Seeger 
Date:   Thu Oct 22 16:22:10 2009 +0200

WHATSNEW: Update changes since 3.4.2.

Karolin
(cherry picked from commit 8e55d149ab4de1a769a8a720e6f432476e719055)

---

Summary of changes:
 WHATSNEW.txt |   88 -
 1 files changed, 86 insertions(+), 2 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 27c3496..9f302aa 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,6 +1,6 @@
=
Release Notes for Samba 3.4.3
- , 2009
+October , 2009
=
 
 
@@ -8,7 +8,8 @@ This is the latest stable release of Samba 3.4.
 
 Major enhancements in Samba 3.4.3 include:
 
-   o
+   o Fix trust relationships to windows 2008 (2008 r2) (bug #6711).
+   o Fix file corruption using smbclient with NT4 server (bug #6606).
 
 
 ##
@@ -19,6 +20,89 @@ Changes since 3.4.2
 ---
 
 
+o   Jeremy Allison 
+* BUG 6529: Offline files conflict with Vista and Office 2003.
+* BUG 6726: SIVAL should have been an SVAL.
+* BUG 6769: Fix symlink unlink.
+* BUG 6774: smbd crashes if "aio write behind" is set.
+* BUG 6776: Fix core dump caused by running overlapping Byte Lock test.
+* BUG 6781: Fix renaming subfolders in Explorer view.
+* BUG 6793: Fix Winbind crash with "INTERNAL ERROR: Signal 6".
+* BUG 6796: Deleting an event context on shutdown can cause smbd to crash.
+
+
+o   GÃ¼nther Deschner 
+* BUG 6711: Fix trust relationships to windows 2008 (2008 r2).
+* BUG 6815: Fix Windows 2008 R2 SPNEGO negTokenTarg parsing failure.
+
+
+o   Olaf Flebbe 
+* BUG 6772: Allow outstanding_aio_calls to be decremented.
+* BUG 6804: Fix hpux compiler issue.
+* BUG 6805: Correctly handle aio_error() and errno.
+
+
+o   BjÃ¶rn Jacke 
+* BUG 6704: Fix syntax error in avahi configure test.
+* BUG 6728: BSD needs sys/sysctl.h included to build properly.
+* BUG 6824: Fix avahi activation.
+* QNX doesn't know uint - replace with uint_t.
+
+
+o   Andrew Klosterman 
+* BUG 6690: Fix wrong error check in profile.
+
+
+o   Marc Aurele La France 
+* BUG 6707: Fix an occasional segfault in config file parsing.
+
+
+o   Jeff Layton 
+* BUG 6810: Add support for finding alternate credcaches to cifs.upcall.
+
+
+o   Volker Lendecke 
+* BUG 6606: Fix file corruption using smbclient with NT4 server.
+* BUG 6703: Allow smbstatus as non-root.
+* BUG 6731: Fix reading beyond the end of a named stream in xattr_streams.
+* BUG 6765: Add a "hidden" parameter "share:fake_fscaps".
+* BUG 6793: Fix segfault in winbindd_pam_auth.
+* BUG 6797: Fix a memleak in libwbclient.
+* BUG 6807: Fix a segfault in "net rpc trustdom list" for long domain 
names.
+* Fix an uninitialized variable.
+* Only ever handle one event after a select call.
+
+
+o   Derrell Lipman 
+* BUG 6532: Fix domain enumeration if master browser has space in name.
+
+
+o   Stefan Metzmacher 
+* BUG 6711: Fix trust relationships to windows 2008 (2008 r2).
+
+
+o   Buchan Milne 
+* BUG 6791: Fix linking order in cifs.upcall.
+
+
+o   Lars MÃ¼ller 
+* BUG 6710: Adjust regex to match variable names including underscores.
+* Conditional install of the cifs.upcall man page.
+
+
+o   Shirish Pargaonkar 
+* BUG 4675: mount.cifs: Do not attempt to update /etc/mtab if it is
+  a symbolic link.
+
+
+o   Simo Sorce 
+* BUG 6764: Fix timeval calculation.
+
+
+o   Bo Yang 
+* BUG 6735: Don't overwrite password in pam_winbind, subsequent pam modules
+  might use the old password and new password.
+* BUG 6811: Fix reference to freed memory in pam_winbind.
 
 
 ##


-- 
Samba Shared Repository

[SCM] Samba Shared Repository - branch v3-4-stable updated

2009-10-26 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  b42a0db... s3:docs: Public is not a synonym for access based 
shareenum.
   via  10bd0b5... s3: Fix crash in pam_winbind, another reference to freed 
memory.
   via  00c42f09.. Fix bug 6829 - smbclient does not show special 
characters properly. All successful calls to cli_session_setup() *must* be 
followed by calls to cli_init_creds() to stash the credentials we successfully 
connected with. There were 2 codepaths where this was missing. This caused 
smbclient to be unable to open the \srvsvc pipe to do an RPC netserverenum, and 
cause it to fall back to a RAP netserverenum, which uses DOS codepage 
conversion rather than the full UCS2 of RPC, so the returned characters were 
not correct (unless the DOS codepage was set correctly). Phew. That was fun to 
track down :-). Includes logic simplification in libsmb_server.c Jeremy. 
(cherry picked from commit 587ca743bf1491e97c984ce4bec5a9bd0a1ae69a)
   via  6cbf9e8... Fix bug 6828 - infinite timeout occurs when byte lock 
held outside of samba Jeremy. (cherry picked from commit 
a572c28ca3daa199d78fc340819c5c9ff53a3ed6)
   via  4cdb4ae... s3: Don't fail authentication when one or some group of 
require-membership-of is invalid.
  from  470f322... WHATSNEW: Update changes since 3.4.2.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit b42a0dbc996d8e40b4893b11445435a781de4afa
Author: Karolin Seeger 
Date:   Mon Oct 26 10:14:51 2009 +0100

s3:docs: Public is not a synonym for access based shareenum.

Fix build warning.

Karolin
(cherry picked from commit 35dc481289c28a77f354dd76193d6298de32c66d)
(cherry picked from commit 7601427a2db1263b0192c1a78d8bacb7eb0b74da)
(cherry picked from commit d6ecfb23cfc841ad0bfe8ae677ddbbba7fd36f31)

commit 10bd0b5e0dcc25f4e6803ca3507b3b09a85f378c
Author: Bo Yang 
Date:   Sat Oct 24 09:20:00 2009 +0800

s3: Fix crash in pam_winbind, another reference to freed memory.

Fix bug #6840.

Signed-off-by: Bo Yang 
(cherry picked from commit b9a3f1dd85d168c15df846dba525f4f882d1acf8)
(cherry picked from commit a0fbf067011ae50d63c6ed2a79f1ff00c2ce2d11)

commit 00c42f0981a10144dc78b86336f5d5177780a4bd
Author: Jeremy Allison 
Date:   Thu Oct 22 15:30:47 2009 -0700

Fix bug 6829 - smbclient does not show special characters properly. All 
successful calls to cli_session_setup() *must* be followed by calls to 
cli_init_creds() to stash the credentials we successfully connected with. There 
were 2 codepaths where this was missing. This caused smbclient to be unable to 
open the \srvsvc pipe to do an RPC netserverenum, and cause it to fall back to 
a RAP netserverenum, which uses DOS codepage conversion rather than the full 
UCS2 of RPC, so the returned characters were not correct (unless the DOS 
codepage was set correctly). Phew. That was fun to track down :-). Includes 
logic simplification in libsmb_server.c Jeremy.
(cherry picked from commit 587ca743bf1491e97c984ce4bec5a9bd0a1ae69a)

commit 6cbf9e806644021aef4ad0d1d97c97e1e972e18e
Author: Jeremy Allison 
Date:   Tue Oct 20 18:10:30 2009 -0700

Fix bug 6828 - infinite timeout occurs when byte lock held outside of samba 
Jeremy.
(cherry picked from commit a572c28ca3daa199d78fc340819c5c9ff53a3ed6)

commit 4cdb4ae29289ef17ad21871f989f18983bc75d36
Author: Bo Yang 
Date:   Thu Oct 15 06:23:48 2009 +0800

s3: Don't fail authentication when one or some group of 
require-membership-of is invalid.

Signed-off-by: Bo Yang 
(cherry picked from commit 31f1a36901b5b8959dc51401c09c114829b50392)

Fix bug #6826.
(cherry picked from commit f383e5f549f9f2075a064ba3d88fa9b34c5e3389)

---

Summary of changes:
 .../smbdotconf/security/accessbasedshareenum.xml   |1 -
 nsswitch/pam_winbind.c |   35 +---
 source3/libsmb/clidfs.c|9 +
 source3/libsmb/libsmb_server.c |8 
 source3/smbd/blocking.c|   26 ++
 5 files changed, 65 insertions(+), 14 deletions(-)


Changeset truncated at 500 lines:

diff --git a/docs-xml/smbdotconf/security/accessbasedshareenum.xml 
b/docs-xml/smbdotconf/security/accessbasedshareenum.xml
index c2977c4..8b94648 100644
--- a/docs-xml/smbdotconf/security/accessbasedshareenum.xml
+++ b/docs-xml/smbdotconf/security/accessbasedshareenum.xml
@@ -3,7 +3,6 @@
  context="S"
  basic="1" advanced="1" developer="1"
 xmlns:samba="http://www.samba.org/samba/DTD/samba-doc";>
- public
  
  If this parameter is yes for a
 service, then the share hosted by the service will only be visible
diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c
index 132d637..ec05f75 100644

[SCM] Samba Shared Repository - branch v3-4-stable updated

2009-10-26 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  4e475de... WHATSNEW: Update release notes.
  from  b42a0db... s3:docs: Public is not a synonym for access based 
shareenum.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 4e475de9c1c2ed5a094a556310fcbfe955b4c884
Author: Karolin Seeger 
Date:   Mon Oct 26 12:02:40 2009 +0100

WHATSNEW: Update release notes.

Karolin
(cherry picked from commit 5158bdcc222cb38b7cf4939e09f6d0fbb7868de2)

---

Summary of changes:
 WHATSNEW.txt |   11 ++-
 1 files changed, 10 insertions(+), 1 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 9f302aa..eef1c15 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,6 +1,6 @@
=
Release Notes for Samba 3.4.3
-October , 2009
+October 29, 2009
=
 
 
@@ -29,6 +29,8 @@ o   Jeremy Allison 
 * BUG 6781: Fix renaming subfolders in Explorer view.
 * BUG 6793: Fix Winbind crash with "INTERNAL ERROR: Signal 6".
 * BUG 6796: Deleting an event context on shutdown can cause smbd to crash.
+* BUG 6828: Fix infinite timeout when byte lock held outside of Samba.
+* BUG 6829: Fix displaying of multibyte characters in smbclient.
 
 
 o   GÃ¼nther Deschner 
@@ -95,6 +97,10 @@ o   Shirish Pargaonkar 
   a symbolic link.
 
 
+o   Karolin Seeger 
+* Fix warning occuring when building the manpages.
+
+
 o   Simo Sorce 
 * BUG 6764: Fix timeval calculation.
 
@@ -103,6 +109,9 @@ o   Bo Yang 
 * BUG 6735: Don't overwrite password in pam_winbind, subsequent pam modules
   might use the old password and new password.
 * BUG 6811: Fix reference to freed memory in pam_winbind.
+* BUG 6826: Don't fail authentication when one or some group of
+  require-membership-of is invalid.
+* BUG 6840: Fix crash in pam_winbind.
 
 
 ##


-- 
Samba Shared Repository

[SCM] Samba Shared Repository - branch v3-4-stable updated

2009-10-29 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  8cd146c... WHATSNEW: Complete release notes.
  from  4e475de... WHATSNEW: Update release notes.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 8cd146c8be065464c0fb702abe5295c6a51c55ca
Author: Karolin Seeger 
Date:   Thu Oct 29 08:45:36 2009 +0100

WHATSNEW: Complete release notes.

Karolin
(cherry picked from commit 508ef0261c56a6d93257d4e2b4cb917cb8bd10bb)

---

Summary of changes:
 WHATSNEW.txt |1 +
 1 files changed, 1 insertions(+), 0 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index eef1c15..ca66189 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -10,6 +10,7 @@ Major enhancements in Samba 3.4.3 include:
 
o Fix trust relationships to windows 2008 (2008 r2) (bug #6711).
o Fix file corruption using smbclient with NT4 server (bug #6606).
+   o Fix Windows 7 share access (which defaults to NTLMv2) (bug #6680).
 
 
 ##


-- 
Samba Shared Repository

[SCM] Samba Shared Repository - branch v3-4-stable updated

2010-01-04 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  656624f... WHATSNEW: Update changes.
   via  2ca6165... Prevent NULL dereference if group has no members
  from  ce98fae... WHATSNEW: Update changes.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 656624f2d643567451f8c7f1f9bb91a6262148fa
Author: Karolin Seeger 
Date:   Mon Jan 4 13:59:21 2010 +0100

WHATSNEW: Update changes.

Karolin
(cherry picked from commit 945b2d1982d4e47aed2552a29e522b3c03b931f4)

commit 2ca6165c786b30f6bd6667a5517e43ea39f79875
Author: Jim McDonough 
Date:   Wed Dec 30 15:04:55 2009 -0500

Prevent NULL dereference if group has no members

Fix bug #7014 (domain mode winbind crashes retriveing empty group members).
(cherry picked from commit 7ea471ba8db84b4fb2f02672e59a9f2a9932b4fa)

---

Summary of changes:
 WHATSNEW.txt|2 ++
 source3/winbindd/winbindd_rpc.c |8 
 2 files changed, 6 insertions(+), 4 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 129cd3f..18d0d31 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -10,6 +10,7 @@ Major enhancements in Samba 3.4.4 include:
 
o Fix interdomain trust relationships with Win2008R2 (bug #6697).
o Fix Winbind crashes when queried from nss (bug #6889).
+   o Fix Winbind crash when retrieving empty group members (bug #7014).
o Fix "UID range full" error in Winbind (bug #6901).
o Fix multiple LDAP servers in "idmap backend" and "idmap alloc
  backend" (bug #6910).
@@ -66,6 +67,7 @@ o   Volker Lendecke 
 
 o   Jim McDonough 
 * BUG 6967: Fix 'net ads join' with OU.
+* BUG 7014: Fix Winbind crash when retrieving empty group members.
 
 
 o   Andrew Tridgell 
diff --git a/source3/winbindd/winbindd_rpc.c b/source3/winbindd/winbindd_rpc.c
index f176fb3..aa8a5c8 100644
--- a/source3/winbindd/winbindd_rpc.c
+++ b/source3/winbindd/winbindd_rpc.c
@@ -789,16 +789,16 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain 
*domain,
 if (!NT_STATUS_IS_OK(result))
return result;
 
-   *num_names = rids->count;
-   rid_mem = rids->rids;
-
-   if (!*num_names) {
+   if (!rids || !rids->count) {
names = NULL;
name_types = NULL;
sid_mem = NULL;
return NT_STATUS_OK;
}
 
+   *num_names = rids->count;
+   rid_mem = rids->rids;
+
 /* Step #2: Convert list of rids into list of usernames.  Do this
in bunches of ~1000 to avoid crashing NT4.  It looks like there
is a buffer overflow or something like that lurking around


-- 
Samba Shared Repository

[SCM] Samba Shared Repository - branch v3-4-stable updated

2010-01-18 Thread Karolin Seeger

The branch, v3-4-stable has been updated
   via  6ac4141... WHATSNEW: Update changes.
   via  04922a5... s3: Fix a crash in libsmbclient used against the 
OpenSolaris CIFS server
   via  724d642... Fix bug 7045 - Bad (non memory copying) interfaces in 
smbc_set calls.
   via  7eff7ca... WHATSNEW: Update changes since 3.4.4.
   via  53a601f... s3-libsmbclient: Fix crash bug in SMBC_parse_path().
   via  41b5680... docs: add -K option to the pdbedit manpage.
   via  56ca077... Fix bug #7036 - net rpc getsid fails in hardened windows 
environments.
   via  8b5a4f6... Fix bug #7034 - vfs_cap causes signal 11 (SIGSEGV) 
(cherry picked from commit ca847952054f5bbde1d40ad4260589b6fcc9721d) (cherry 
picked from commit 62bed0de7f6dbde183c3002253008941c4b88b3f)
   via  dc92cbb... smbd: Fix opening the quota magic file
   via  5eec352... Re-fix bug 5202 - cannot change ACLs on writable file 
with "dos filemode=yes"
   via  ed27534... Second part of the fix for bug #7020 - smbd using 2G 
memory.
   via  bb064b9... Fix bug #7020 - smbd using 2G memory.
   via  e68c574... WHATSNEW: Start release notes for 3.4.5.
   via  3b05073... VERSION: Raise version number up to 3.4.5.
  from  656624f... WHATSNEW: Update changes.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-4-stable


- Log -
commit 6ac41410868711200442413dad6461771cda977b
Author: Karolin Seeger 
Date:   Mon Jan 18 12:37:16 2010 +0100

WHATSNEW: Update changes.

Karolin
(cherry picked from commit fb7af5cfcf4f8c45e4c56f85a82eb93647068c8b)

commit 04922a546878687f6684b403f4fd250c03033e9d
Author: Volker Lendecke 
Date:   Sat Jan 16 13:31:44 2010 +0100

s3: Fix a crash in libsmbclient used against the OpenSolaris CIFS server

A user has sent me a sniff where the OpenSolaris CIFS server returns "32" in
totalentries, but the array in ctr only contains 15 entries. Look at the 
right
delimiter for walking the array.

Fix bug #7046 (libsmbclient crash against OpenSolaris CIFS server).
(cherry picked from commit 734446bb3a8984ec805c73e06e553312b46e4094)

commit 724d6423c961e01745128dbc58c7946f1e36b043
Author: Jeremy Allison 
Date:   Fri Jan 15 17:49:56 2010 -0800

Fix bug 7045 - Bad (non memory copying) interfaces in smbc_set calls.

In smbc_free_context libsmbclient just called free() on the string options
so it assumes the callers have malloced them before setting them via 
smbc_set
calls.

Change to correctly malloc/free string options to the library.
Protect against SMB_STRDUP of null.

Contains 2d41b1ab78639abe4ae030ff482573f464564dd7 and
f85b6ee90b88c7f7b2a92c8a5f3e2ebe59c1087b from master.

Jeremy
(cherry picked from commit 1d9dc38aec417c8ccc9fa34d32015ee57d877ba9)

commit 7eff7ca9c099e887bbedc15ed973e83a0ab47712
Author: Karolin Seeger 
Date:   Fri Jan 15 15:26:20 2010 +0100

WHATSNEW: Update changes since 3.4.4.

Karolin
(cherry picked from commit b8ff43eedef4315595e6b4c4467e8e2d8d19ffc4)

commit 53a601ff30fa7b6cf2014b1b09a9736ea9b36399
Author: GÃ¼nther Deschner 
Date:   Thu Jan 14 19:34:26 2010 +0100

s3-libsmbclient: Fix crash bug in SMBC_parse_path().

Patch from Tim Waugh .
This resolves https://bugzilla.redhat.com/show_bug.cgi?id=552658

LIBSMBCLIENT-OPENDIR torture test checks this as well.

Guenther
(cherry picked from commit e635b0074c55e0376495abe940355aa7b04f0b70)

Fix bug #7043 (SIGSEGV in "SMBC_parse_path").
(cherry picked from commit 01009416998219a27268211a3ae26d7b3ab157f8)

commit 41b56802df244a45bae188e186323f86c2a38531
Author: Michael Adam 
Date:   Tue Jan 12 08:39:36 2010 +0100

docs: add -K option to the pdbedit manpage.

Thanks to Oota Toshiya  for pointing this out!

Michael

Fix bug #7041.
(cherry picked from commit 918045b22b1607acf51c40d8c8765862f3400a1d)

commit 56ca0778fb492e60ec64307f06a8ec84b5889561
Author: Jeremy Allison 
Date:   Thu Jan 14 15:39:30 2010 -0800

Fix bug #7036 - net rpc getsid fails in hardened windows environments.

Fix suggested by dave.daughe...@centrify.com.
(cherry picked from commit 6653cc43233381a941cdd85550f04b087fe880ff)
(cherry picked from commit 59b46630ac205bdfe409c0c8b60dc5f5ddad5cf1)

commit 8b5a4f62106616431ee32cc85cd5186c704dbc44
Author: SASAJIMA Toshihiro 
Date:   Tue Jan 12 21:43:23 2010 -0800

Fix bug #7034 - vfs_cap causes signal 11 (SIGSEGV) (cherry picked from 
commit ca847952054f5bbde1d40ad4260589b6fcc9721d)
(cherry picked from commit 62bed0de7f6dbde183c3002253008941c4b88b3f)

commit dc92cbbe3a1c26e6e98794ff9ce6e7bbdcceedd8
Author: Stefan Metzmacher 
Date:   Mon Dec 21 16:26:34 2009 +0100

smbd: Fix opening the quota magic file

This fixes bug #6642 and bug #6919.

metze
(cherry picked from commit 7fd0767c6abdc9f4c45

[SCM] Samba Shared Repository - branch v3-4-stable updated

2010-02-17 Thread Karolin Seeger

The branch, v3-4-stable has been updated
via 34d5071... WHATSNEW: Update changes since 3.4.5.
via 45b2e94... cifs.upcall: allocate a talloc context for
smb_krb5_unparse_name
via 27b8ae5... s3-docs: Add missing para end tag.
via f57eeba... spoolss: disable GetPrinterDriver level 101 (as called
by XP).
via c02c05d... s3-docs: fix eventlogadm manpage typo.
via c4607c0... Fixes issue with preexec scripts creating a share
directory, and problems if a smb.conf reload turns wide links back on after a
connection is establised.
via e6f9d3c... s3: Fix typo found by jhell (cherry
picked from commit 271a4c60dbec0d001dc55df58de8e54274137853) (cherry picked
from commit eb390b8f917f52eb28f46f39a19abdc717051f3d) (cherry picked from
commit f8dbb021393edf9d8394b5b7adf03c3432257ce7)
via 6f807f5... s3-spoolss: implement spoolss_EnumJobs level 3.
via 7b6b5c4... s3:passdb: only use gid_to_sid() result if the result is
a group of our local sam
via 2c08182... s3:pdb_ldap: don't search for the users primary group,
if we already know it
via adaaf2c... s3:pdb_ldap: optimize ldapsam_alias_memberships() and
cache ldap searches.
via 9cae496... s3:pdb_ldap: try to build the full unix_pw structure
with ldapsam:trusted support
via c19ee2b... s3:passdb: speed up pdb_get_group_sid()
via bece99d... s3: Make pdb_copy_sam_account also copy the group sid
via 35752c0... s3: shortcut gid_to_sid when "ldapsam:trusted = yes"
via b9ec2da... s3:is_trusted_domain: shortcut if domain name ==
global_sam_name
via 07019c3... s3:is_trusted_domain: shortcut if domain name is NULL or
empty
via 17ef5e9... s3: shortcut uid_to_sid when "ldapsam:trusted = yes"
via ba734d2... s3:smbd: also fill the memcache with sid<->id mappings
in ldapsam_sid_to_id()
via a635050... s3:smbd: make idmap cache persistent for
"ldapsam:trusted".
via 12f4e9a... Fix large paged search
via a50dc30...
=?utf-8?q?=D1=953:ldap:=20search=20for=20account=20policies=20in=20objectclass=20sambaDomain,=20not=20*
via d416973... s3:ldap: don't search when no values where found (cherry
picked from commit 70063522065ab3e5a21fb11db0097b808aa11100)
via 9206eb8... Fix bug #7122 - Reading a large browselist fails (server
returns invalid values in subsequent SMBtrans replies)
via f030e76... Fix off-by-one error in working out the limit of the
NetServerEnum comment.
via 5ea0fbb... s3:smbd: use StrCaseCmp() instead of strcasecmp
via f364e84... s3:smbd: Fix really ugly bool vs. int bug!!!
via 7948c58... s3:libsmb: fix NetServerEnum3 rap calls.
via f7c5a16... s3:smbd: implement api_RNetServerEnum3
via fdc1887... util: added binsearch.h for binary array searches
via dddb1c4... s3:smbd: add/improve some DEBUG messages in
api_RNetServerEnum2()
via 8e336a0... s3:smbd: rename api_RNetServerEnum => api_RNetServerEnum2
via c0fa8a3... Missed one check on the memcpy for bug #7063.
via 17a37d5... Second part of fix for bug 7063 - Samba 3.4.5 on ubuntu
8.04 64 bit - Core dumps.
via ae430b8... Fix bug 7104 - "wide links" and "unix extensions" are
incompatible.
via 799f1d9... Fix bug 7063 - Samba 3.4.5 on ubuntu 8.04 64 bit - Core
dumps.
via fc6616e... s3: Fix an uninitialized variable reference
via 4d8fb15... s3: Fix malformed require_membership_of_sid.
via 91a38a7... s3: normalize "Changing password for" msg IDs and STRs
via 42a78fb... s3:libsmb: don't reuse the callers stype variable in
cli_NetServerEnum()
via 2614774... Add cross option to samba_cv_linux_getgrouplist_ok
via fff94aa... s3/smbd: Fix string buffer overflow causing heap
corruption
via b5c8ef8... s3: Simplify the code a bit: Catch (len==0) early
via fb5f17d... Fix bug 7081 - vfs_expand_msdfs doesn't work correctly
(with fix identified)
via afbf11a... Fix bug #7072 - Accounts can't be unlocked from ldap.
via c81c109... Fix bug #7067 - Linux asynchronous IO (aio) can cause
smbd to fail to respond to a read or write.
via 389c94a... Do not segfault in pdb_search_destructor if no real
search was started (cherry picked from commit
d07464b21fe652e205f5eb2c74d12495bab100ce)
via 3b330fe... s3-docs: Adapt version in man ldbrename.
via 21a797c... s3/docs: Add missing meta data to man ldbrename.
via 8e2eece... s3: Fix bug 7052: "DFS broken on AIX (maybe others)"
(cherry picked from commit c531d00abdb19ff6ba4c60ebdcc8319949c6) (cherry
picked from commit f21796955e7aa2e84a1c810612f2fdee2bde611c) (cherry picked
from commit 28b3cf328312a26cd72bbc54f3283bc46b51bc32)
via 2e75a6a... s3-docs: Fix typos.
via 90b0ff5... s3:pdb_ldap: restore Samba 3.0.x behavior and use the
first "uid" value.
via 35aa00b... s3:smbldap: add s

77 matches

Mail list logo