From 786265ad7ffd6d3b8438c18f62a2a027c50fde6d Mon Sep 17 00:00:00 2001
From: Jo Sutton <josutton@catalyst.net.nz>
Date: Tue, 30 Jul 2024 15:42:32 +1200
Subject: [PATCH] s3:libsmb: Fix invalid array dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

If ‘num_addrs’ is equal to zero, name_queries_send() will pass an
invalid address to name_query_send().

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---
 source3/libsmb/namequery.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/source3/libsmb/namequery.c b/source3/libsmb/namequery.c
index 9a47f034d38..48210d92847 100644
--- a/source3/libsmb/namequery.c
+++ b/source3/libsmb/namequery.c
@@ -1701,6 +1701,10 @@ static struct tevent_req *name_queries_send(
 	struct tevent_req *req, *subreq;
 	struct name_queries_state *state;
 
+	if (num_addrs == 0) {
+		return NULL;
+	}
+
 	req = tevent_req_create(mem_ctx, &state,
 				struct name_queries_state);
 	if (req == NULL) {
-- 
2.47.3