kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Security: CVE-2010-2063

Browse source 
Feature safe:	yes
Address CVE-2010-2063
This commit is contained in:
Timur I. Bakeyev 2010-06-18 12:58:06 +00:00
parent 0c433e540f
commit c61373e837
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=256665
2 changed files with 44 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
net/samba32/Makefile
View file

@ -7,6 +7,7 @@
PORTNAME= samba
PORTVERSION?= 3.2.15
PORTREVISION?= 1
CATEGORIES?= net
MASTER_SITES= ${MASTER_SITE_SAMBA}
MASTER_SITE_SUBDIR= . old-versions rc pre
@ -15,7 +16,12 @@ DISTNAME= ${PORTNAME}-${PORTVERSION:S/.p/pre/:S/.r/rc/}
MAINTAINER?= timur@FreeBSD.org
COMMENT?= A free SMB and CIFS client and server for UNIX
CONFLICTS?= *samba-3.[03].* samba4* tdb-1.* talloc-1.*
CONFLICTS?= *samba-3.[03-5].* samba4* tdb-1.* talloc-1.*
EXPIRATION_DATE= 2010-09-01
DEPRECATED= Unsupported by the upstream. Please, consider to upgrade.
EXTRA_PATCHES= ${PATCHDIR}/CVE-2010-2063_samba-3.3.patch
USE_GMAKE= yes
USE_ICONV= yes

37
net/samba32/files/CVE-2010-2063_samba-3.3.patch Normal file
View file

@ -0,0 +1,37 @@
diff --git a/source/smbd/process.c b/source/smbd/process.c
index 446b868..403c7c6 100644
--- smbd/process.c
+++ smbd/process.c
@@ -1645,6 +1645,7 @@ void construct_reply_common(const char *inbuf, char *outbuf)
void chain_reply(struct smb_request *req)
{
static char *orig_inbuf;
+ static int orig_size;
/*
* Dirty little const_discard: We mess with req->inbuf, which is
@@ -1679,13 +1680,24 @@ void chain_reply(struct smb_request *req)
if (chain_size == 0) {
/* this is the first part of the chain */
orig_inbuf = inbuf;
+ orig_size = size;
}
+ /* Validate smb_off2 */
+ if ((smb_off2 < smb_wct - 4) || orig_size < (smb_off2 + 4 - smb_wct)) {
+ exit_server_cleanly("Bad chained packet");
+ return;
+ }
/*
* We need to save the output the caller added to the chain so that we
* can splice it into the final output buffer later.
*/
+ if (outsize <= smb_wct) {
+ exit_server_cleanly("Bad chained packet");
+ return;
+ }
+
caller_outputlen = outsize - smb_wct;
caller_output = (char *)memdup(outbuf + smb_wct, caller_outputlen);