From: Jeremy Allison Date: Thu, 13 Jul 2017 19:06:58 +0000 (-0700) Subject: s3: smbd: Fix a read after free if a chained SMB1 call goes async. X-Git-Tag: samba-4.5.13~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cfa8c189da1a4dbbf00d76068fbf2a11c0837747;p=thirdparty%2Fsamba.git s3: smbd: Fix a read after free if a chained SMB1 call goes async. Reported to the Samba Team by Yihan Lian , a security researcher of Qihoo 360 GearTeam. Thanks a lot! smb1_parse_chain() incorrectly used talloc_tos() for the memory context of the chained smb1 requests. This gets freed between requests so if a chained request goes async, the saved request array also is freed, which causes a crash on resume. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12836 Signed-off-by: Jeremy Allison Reviewed-by: Stefan Metzmacher (cherry picked from commit 5fe76a5474823ed7602938a07c9c43226a7882a3) Autobuild-User(v4-5-test): Karolin Seeger Autobuild-Date(v4-5-test): Tue Jul 25 05:32:53 CEST 2017 on sn-devel-144 --- diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 8f097ecbc00..656f1c0a667 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -1784,7 +1784,7 @@ static void construct_reply_chain(struct smbXsrv_connection *xconn, unsigned num_reqs; bool ok; - ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, xconn, encrypted, + ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted, seqnum, &reqs, &num_reqs); if (!ok) { char errbuf[smb_size];