samba: update init scripts to fix install
[opendreambox.git] / meta-opendreambox / recipes-connectivity / samba / samba-3.0.37 / samba-3.0.37-CVE-2012-1182.patch
1 From e11637c2c89c2d38963311416c34a4767b19e175 Mon Sep 17 00:00:00 2001
2 From: Stefan Metzmacher <metze@samba.org>
3 Date: Sat, 17 Mar 2012 01:22:27 +0100
4 Subject: [PATCH] s3:librpc/gen_ndr: fix array checks (bug #8815 / CVE-2012-1182)
5
6 An Anonymous researcher working with HP's Zero Day Initiative program
7 has found this and notified us.
8
9 metze
10 ---
11  source/librpc/gen_ndr/ndr_wkssvc.c |   12 ++++++------
12  1 files changed, 6 insertions(+), 6 deletions(-)
13
14 diff --git source/librpc/gen_ndr/ndr_wkssvc.c source/librpc/gen_ndr/ndr_wkssvc.c
15 index 2af3587..07cf1a1 100644
16 --- source/librpc/gen_ndr/ndr_wkssvc.c
17 +++ source/librpc/gen_ndr/ndr_wkssvc.c
18 @@ -1385,10 +1385,10 @@ NTSTATUS ndr_pull_USER_INFO_0_CONTAINER(struct ndr_pull *ndr, int ndr_flags, str
19                         NDR_PULL_ALLOC_N(ndr, r->user0, ndr_get_array_size(ndr, &r->user0));
20                         _mem_save_user0_1 = NDR_PULL_GET_MEM_CTX(ndr);
21                         NDR_PULL_SET_MEM_CTX(ndr, r->user0, 0);
22 -                       for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
23 +                       for (cntr_user0_1 = 0; cntr_user0_1 < ndr_get_array_size(ndr, &r->user0); cntr_user0_1++) {
24                                 NDR_CHECK(ndr_pull_USER_INFO_0(ndr, NDR_SCALARS, &r->user0[cntr_user0_1]));
25                         }
26 -                       for (cntr_user0_1 = 0; cntr_user0_1 < r->entries_read; cntr_user0_1++) {
27 +                       for (cntr_user0_1 = 0; cntr_user0_1 < ndr_get_array_size(ndr, &r->user0); cntr_user0_1++) {
28                                 NDR_CHECK(ndr_pull_USER_INFO_0(ndr, NDR_BUFFERS, &r->user0[cntr_user0_1]));
29                         }
30                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user0_1, 0);
31 @@ -1631,10 +1631,10 @@ NTSTATUS ndr_pull_USER_INFO_1_CONTAINER(struct ndr_pull *ndr, int ndr_flags, str
32                         NDR_PULL_ALLOC_N(ndr, r->user1, ndr_get_array_size(ndr, &r->user1));
33                         _mem_save_user1_1 = NDR_PULL_GET_MEM_CTX(ndr);
34                         NDR_PULL_SET_MEM_CTX(ndr, r->user1, 0);
35 -                       for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
36 +                       for (cntr_user1_1 = 0; cntr_user1_1 < ndr_get_array_size(ndr, &r->user1); cntr_user1_1++) {
37                                 NDR_CHECK(ndr_pull_USER_INFO_1(ndr, NDR_SCALARS, &r->user1[cntr_user1_1]));
38                         }
39 -                       for (cntr_user1_1 = 0; cntr_user1_1 < r->entries_read; cntr_user1_1++) {
40 +                       for (cntr_user1_1 = 0; cntr_user1_1 < ndr_get_array_size(ndr, &r->user1); cntr_user1_1++) {
41                                 NDR_CHECK(ndr_pull_USER_INFO_1(ndr, NDR_BUFFERS, &r->user1[cntr_user1_1]));
42                         }
43                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_user1_1, 0);
44 @@ -1953,10 +1953,10 @@ NTSTATUS ndr_pull_wkssvc_NetWkstaTransportCtr0(struct ndr_pull *ndr, int ndr_fla
45                         NDR_PULL_ALLOC_N(ndr, r->array, ndr_get_array_size(ndr, &r->array));
46                         _mem_save_array_1 = NDR_PULL_GET_MEM_CTX(ndr);
47                         NDR_PULL_SET_MEM_CTX(ndr, r->array, 0);
48 -                       for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
49 +                       for (cntr_array_1 = 0; cntr_array_1 < ndr_get_array_size(ndr, &r->array); cntr_array_1++) {
50                                 NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_SCALARS, &r->array[cntr_array_1]));
51                         }
52 -                       for (cntr_array_1 = 0; cntr_array_1 < r->count; cntr_array_1++) {
53 +                       for (cntr_array_1 = 0; cntr_array_1 < ndr_get_array_size(ndr, &r->array); cntr_array_1++) {
54                                 NDR_CHECK(ndr_pull_wkssvc_NetWkstaTransportInfo0(ndr, NDR_BUFFERS, &r->array[cntr_array_1]));
55                         }
56                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_array_1, 0);
57 -- 
58 1.7.4.1
59