From: Samuel Cabrero <scabrero@suse.de>
Date: Mon, 18 Feb 2019 18:34:38 +0000 (+0100)
Subject: s3:rpc_server: Check remote address supplied to dcerpc_ncacn_accept
X-Git-Tag: talloc-2.3.0~23
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=82759189d16449d7e4cb23a353d99e2254437898;p=thirdparty%2Fsamba.git

s3:rpc_server: Check remote address supplied to dcerpc_ncacn_accept

Check if the supplied tsocket_address is valid before changing the
talloc chunk parent to the ncacn_conn struct.

Signed-off-by: Samuel Cabrero <scabrero@suse.de>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/source3/rpc_server/rpc_server.c b/source3/rpc_server/rpc_server.c
index e8752d5ec2b..72bcd1672f7 100644
--- a/source3/rpc_server/rpc_server.c
+++ b/source3/rpc_server/rpc_server.c
@@ -1065,21 +1065,25 @@ void dcerpc_ncacn_accept(struct tevent_context *ev_ctx,
 
 	ncacn_conn->sock = s;
 
-	ncacn_conn->remote_client_addr = talloc_move(ncacn_conn, &cli_addr);
-	if (tsocket_address_is_inet(ncacn_conn->remote_client_addr, "ip")) {
-		ncacn_conn->remote_client_name =
-			tsocket_address_inet_addr_string(ncacn_conn->remote_client_addr,
-							 ncacn_conn);
-	} else {
-		ncacn_conn->remote_client_name =
-			tsocket_address_unix_path(ncacn_conn->remote_client_addr,
-						  ncacn_conn);
-	}
-	if (ncacn_conn->remote_client_name == NULL) {
-		DEBUG(0, ("Out of memory obtaining remote socket address as a string!\n"));
-		talloc_free(ncacn_conn);
-		close(s);
-		return;
+	if (cli_addr != NULL) {
+		ncacn_conn->remote_client_addr = talloc_move(ncacn_conn, &cli_addr);
+
+		if (tsocket_address_is_inet(ncacn_conn->remote_client_addr, "ip")) {
+			ncacn_conn->remote_client_name =
+				tsocket_address_inet_addr_string(ncacn_conn->remote_client_addr,
+								 ncacn_conn);
+		} else {
+			ncacn_conn->remote_client_name =
+				tsocket_address_unix_path(ncacn_conn->remote_client_addr,
+							  ncacn_conn);
+		}
+
+		if (ncacn_conn->remote_client_name == NULL) {
+			DBG_ERR("Out of memory obtaining remote socket address as a string!\n");
+			talloc_free(ncacn_conn);
+			close(s);
+			return;
+		}
 	}
 
 	if (srv_addr != NULL) {