From 189a71748c9636097c7d56c65ef521590c96e397 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Thu, 13 Jul 2017 12:06:58 -0700 Subject: [PATCH] s3: smbd: Fix a read after free if a chained SMB1 call goes async. Reported to the Samba Team by Yihan Lian , a security researcher of Qihoo 360 GearTeam. Thanks a lot! smb1_parse_chain() incorrectly used talloc_tos() for the memory context of the chained smb1 requests. This gets freed between requests so if a chained request goes async, the saved request array also is freed, which causes a crash on resume. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12836 Signed-off-by: Jeremy Allison Reviewed-by: Stefan Metzmacher (cherry picked from commit 5fe76a5474823ed7602938a07c9c43226a7882a3) Autobuild-User(v4-4-test): Karolin Seeger Autobuild-Date(v4-4-test): Tue Jul 25 01:31:58 CEST 2017 on sn-devel-144 --- source3/smbd/process.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 47fd16fe6ff..b1b2b92e4c8 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -1784,7 +1784,7 @@ static void construct_reply_chain(struct smbXsrv_connection *xconn, unsigned num_reqs; bool ok; - ok = smb1_parse_chain(talloc_tos(), (uint8_t *)inbuf, xconn, encrypted, + ok = smb1_parse_chain(xconn, (uint8_t *)inbuf, xconn, encrypted, seqnum, &reqs, &num_reqs); if (!ok) { char errbuf[smb_size]; -- 2.47.2