]> git.ipfire.org Git - thirdparty/samba.git/commit
s3: smbd: init_smb1_request() isn't being passed zero'ed memory from any codepath.
authorJeremy Allison <jra@samba.org>
Sat, 12 Aug 2023 00:14:38 +0000 (17:14 -0700)
committerJule Anger <janger@samba.org>
Thu, 17 Aug 2023 11:26:11 +0000 (11:26 +0000)
commit098e5f240a5561a7d57d936d9d01eba8994fa91f
tree5556f9497168d34c8ad260ff8aa1d0bf0c2db8c6
parenteb95b15b1ba06ad8fefaa71ff2cfec6f8973bd20
s3: smbd: init_smb1_request() isn't being passed zero'ed memory from any codepath.

If a client does a SMB1 NEGPROT followed by SMB1 TCON
then req->session is left uninitialized.

Show this causes a crash by deliberately initializing
req->session to an invalid pointer. This will be removed
once the test shows the crash, and the fix is added to
cause init_smb1_request() to zero the memory passed in.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15432

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Noel Power <npower@samba.org>
(Back-ported from commit f02f74e931f5821c7b7c1be2b8f0fb60c9a69b19)
source3/smbd/smb2_process.c