From 67d9b58a0dd35f79c249216b0d7239bb03ab9904 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 14 May 2026 13:34:13 +0200 Subject: [PATCH] s3:rpc_server/dfs: fix temporary read of unrelated or non-existing memory This was reported by Arjun Basnet with Securin Labs. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16093 Signed-off-by: Stefan Metzmacher Reviewed-by: Gary Lockyer (cherry picked from commit 3b7730b3702875d92b5dc0e90410ae26c7355138) --- source3/rpc_server/dfs/srv_dfs_nt.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/source3/rpc_server/dfs/srv_dfs_nt.c b/source3/rpc_server/dfs/srv_dfs_nt.c index 262603483ebb..a615ab4d1f63 100644 --- a/source3/rpc_server/dfs/srv_dfs_nt.c +++ b/source3/rpc_server/dfs/srv_dfs_nt.c @@ -57,7 +57,6 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r) struct auth_session_info *session_info = dcesrv_call_session_info(dce_call); struct junction_map *jn = NULL; - struct referral *old_referral_list = NULL; bool self_ref = False; size_t consumedcnt = 0; char *altpath = NULL; @@ -106,23 +105,19 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r) } jn->referral_count += 1; - old_referral_list = jn->referral_list; - if (jn->referral_count < 1) { return WERR_NOT_ENOUGH_MEMORY; } - jn->referral_list = talloc_array(ctx, struct referral, jn->referral_count); + jn->referral_list = talloc_realloc(ctx, + jn->referral_list, + struct referral, + jn->referral_count); if(jn->referral_list == NULL) { DBG_ERR("talloc failed for referral list!\n"); return WERR_NERR_DFSINTERNALERROR; } - if(old_referral_list && jn->referral_list) { - memcpy(jn->referral_list, old_referral_list, - sizeof(struct referral)*jn->referral_count-1); - } - jn->referral_list[jn->referral_count-1].proximity = 0; jn->referral_list[jn->referral_count-1].ttl = REFERRAL_TTL; jn->referral_list[jn->referral_count-1].alternate_path = altpath; -- 2.43.0