Project

General

Profile

Bug #1761

Codenomicon findings in smbsrv

Added by Gordon Ross about 8 years ago. Updated about 8 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Category:
-
Start date:
2011-11-10
Due date:
% Done:

0%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage

Description

Some misc. bugs found and fixed at a recent plug fest, thanks to the excellent test tools from the folks at codenomicon.com (who made their tools available at the event). These are hard to reproduce, but were fixed and verified at the plug fest.

History

#1

Updated by Gordon Ross about 8 years ago

Three fixes, in each of three files:

  • usr/src/uts/common/fs/smbsrv/smb_mbuf_marshaling.c

Panic in mbc_marshal_get_uio() with req. specifying I/O size larger than actual message.

  • usr/src/uts/common/fs/smbsrv/smb_nt_transact_notify_change.c

Panic in smb_nt_transact_notify_change() when called
for things that do not have a node.

  • usr/src/uts/common/fs/smbsrv/smb_session.c

Panic handling a bad request followed immediately by cancel.

#2

Updated by Gordon Ross about 8 years ago

  • Status changed from New to Resolved
changeset:   13516:5a0585080fb5
tag:         tip
user:        Gordon Ross <gwr@nexenta.com>
date:        Fri Nov 11 21:50:53 2011 -0500
description:
    1761 Codenomicon findings in smbsrv
    Reviewed by: Dan McDonald <danmcd@nexenta.com>
    Reviewed by: Albert Lee <trisk@nexenta.com>
    Approved by: Garrett D'Amore <garrett@nexenta.com>

Also available in: Atom PDF