From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 14 May 2026 11:34:13 +0000 (+0200)
Subject: s3:rpc_server/dfs: fix temporary read of unrelated or non-existing memory
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3b7730b3702875d92b5dc0e90410ae26c7355138;p=thirdparty%2Fsamba.git

s3:rpc_server/dfs: fix temporary read of unrelated or non-existing memory

This was reported by Arjun Basnet with Securin Labs.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16093

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
---

diff --git a/source3/rpc_server/dfs/srv_dfs_nt.c b/source3/rpc_server/dfs/srv_dfs_nt.c
index ec581d172ac..dbeba5ef891 100644
--- a/source3/rpc_server/dfs/srv_dfs_nt.c
+++ b/source3/rpc_server/dfs/srv_dfs_nt.c
@@ -558,7 +558,6 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r)
 	struct auth_session_info *session_info =
 		dcesrv_call_session_info(dce_call);
 	struct junction_map *jn = NULL;
-	struct referral *old_referral_list = NULL;
 	bool self_ref = False;
 	size_t consumedcnt = 0;
 	char *altpath = NULL;
@@ -607,23 +606,19 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r)
 	}
 
 	jn->referral_count += 1;
-	old_referral_list = jn->referral_list;
-
 	if (jn->referral_count < 1) {
 		return WERR_NOT_ENOUGH_MEMORY;
 	}
 
-	jn->referral_list = talloc_array(ctx, struct referral, jn->referral_count);
+	jn->referral_list = talloc_realloc(ctx,
+					   jn->referral_list,
+					   struct referral,
+					   jn->referral_count);
 	if(jn->referral_list == NULL) {
 		DBG_ERR("talloc failed for referral list!\n");
 		return WERR_NERR_DFSINTERNALERROR;
 	}
 
-	if(old_referral_list && jn->referral_list) {
-		memcpy(jn->referral_list, old_referral_list,
-				sizeof(struct referral)*jn->referral_count-1);
-	}
-
 	jn->referral_list[jn->referral_count-1].proximity = 0;
 	jn->referral_list[jn->referral_count-1].ttl = REFERRAL_TTL;
 	jn->referral_list[jn->referral_count-1].alternate_path = altpath;