From a9abb0bfbf1cc70b7082f4fd40152b11c91f7634 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 14 May 2026 13:34:13 +0200 Subject: [PATCH] s3:rpc_server/dfs: fix temporary read of unrelated or non-existing memory This was reported by Arjun Basnet with Securin Labs. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16093 Signed-off-by: Stefan Metzmacher Reviewed-by: Gary Lockyer (cherry picked from commit 3b7730b3702875d92b5dc0e90410ae26c7355138) --- source3/rpc_server/dfs/srv_dfs_nt.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/source3/rpc_server/dfs/srv_dfs_nt.c b/source3/rpc_server/dfs/srv_dfs_nt.c index d8aeb76a1fb8..3c7ad5d5053c 100644 --- a/source3/rpc_server/dfs/srv_dfs_nt.c +++ b/source3/rpc_server/dfs/srv_dfs_nt.c @@ -57,7 +57,6 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r) struct auth_session_info *session_info = dcesrv_call_session_info(dce_call); struct junction_map *jn = NULL; - struct referral *old_referral_list = NULL; bool self_ref = False; size_t consumedcnt = 0; char *altpath = NULL; @@ -104,23 +103,19 @@ WERROR _dfs_Add(struct pipes_struct *p, struct dfs_Add *r) } jn->referral_count += 1; - old_referral_list = jn->referral_list; - if (jn->referral_count < 1) { return WERR_NOT_ENOUGH_MEMORY; } - jn->referral_list = talloc_array(ctx, struct referral, jn->referral_count); + jn->referral_list = talloc_realloc(ctx, + jn->referral_list, + struct referral, + jn->referral_count); if(jn->referral_list == NULL) { DEBUG(0,("init_reply_dfs_add: talloc failed for referral list!\n")); return WERR_NERR_DFSINTERNALERROR; } - if(old_referral_list && jn->referral_list) { - memcpy(jn->referral_list, old_referral_list, - sizeof(struct referral)*jn->referral_count-1); - } - jn->referral_list[jn->referral_count-1].proximity = 0; jn->referral_list[jn->referral_count-1].ttl = REFERRAL_TTL; jn->referral_list[jn->referral_count-1].alternate_path = altpath; -- 2.43.0