summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTiziano Müller <dev-zero@gentoo.org>2008-02-27 19:19:49 +0000
committerTiziano Müller <dev-zero@gentoo.org>2008-02-27 19:19:49 +0000
commita1044a41187b250704839e08c28318f5ac77a522 (patch)
tree76e1b9c478ad0e803583bbd7adf43b0481253fd5 /net-fs/samba/files
parentVersion bump (diff)
downloadgentoo-2-a1044a41187b250704839e08c28318f5ac77a522.tar.gz
gentoo-2-a1044a41187b250704839e08c28318f5ac77a522.tar.bz2
gentoo-2-a1044a41187b250704839e08c28318f5ac77a522.zip
Fixed double pam_*.so installation (bug #207021, thanks to flameeyes). Dropped old version and patches.
(Portage version: 2.1.4.4)
Diffstat (limited to 'net-fs/samba/files')
-rw-r--r--net-fs/samba/files/3.0.24-heap_overflow_v2.patch785
-rw-r--r--net-fs/samba/files/3.0.24-shell_escape.patch252
-rw-r--r--net-fs/samba/files/3.0.24-sid2name_elevation_v2.patch168
3 files changed, 0 insertions, 1205 deletions
diff --git a/net-fs/samba/files/3.0.24-heap_overflow_v2.patch b/net-fs/samba/files/3.0.24-heap_overflow_v2.patch
deleted file mode 100644
index 54b5cbbc2dae..000000000000
--- a/net-fs/samba/files/3.0.24-heap_overflow_v2.patch
+++ /dev/null
@@ -1,785 +0,0 @@
-Index: samba-3.0.24/source/include/smb_macros.h
-===================================================================
---- samba-3.0.24.orig/source/include/smb_macros.h 2006-04-19 21:29:39.000000000 -0500
-+++ samba-3.0.24/source/include/smb_macros.h 2007-05-25 12:40:05.000000000 -0500
-@@ -310,7 +310,6 @@
- #if defined(PARANOID_MALLOC_CHECKER)
-
- #define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem_((ps),sizeof(type),(count))
--#define PRS_ALLOC_MEM_VOID(ps, size) prs_alloc_mem_((ps),(size),1)
-
- /* Get medieval on our ass about malloc.... */
-
-@@ -354,7 +353,6 @@
- #define __location__ __FILE__ ":" __LINESTR__
-
- #define PRS_ALLOC_MEM(ps, type, count) (type *)prs_alloc_mem((ps),sizeof(type),(count))
--#define PRS_ALLOC_MEM_VOID(ps, size) prs_alloc_mem((ps),(size),1)
-
- /* Regular malloc code. */
-
-Index: samba-3.0.24/source/rpc_parse/parse_dfs.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_dfs.c 2007-02-04 12:59:22.000000000 -0600
-+++ samba-3.0.24/source/rpc_parse/parse_dfs.c 2007-05-25 12:40:05.000000000 -0500
-@@ -325,7 +325,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->stores = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->stores)*v->num_stores);
-+ v->stores = PRS_ALLOC_MEM(ps,NETDFS_DFS_STORAGEINFO,v->num_stores);
-+ if (!v->stores)
-+ return False;
- }
- for (i_stores_1=0; i_stores_1<v->num_stores;i_stores_1++) {
- if (!netdfs_io_dfs_StorageInfo_p("stores", &v->stores[i_stores_1], ps, depth))
-@@ -447,7 +449,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->stores = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->stores)*v->num_stores);
-+ v->stores = PRS_ALLOC_MEM(ps,NETDFS_DFS_STORAGEINFO,v->num_stores);
-+ if (!v->stores)
-+ return False;
- }
- for (i_stores_1=0; i_stores_1<v->num_stores;i_stores_1++) {
- if (!netdfs_io_dfs_StorageInfo_p("stores", &v->stores[i_stores_1], ps, depth))
-@@ -920,7 +924,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->s = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->s)*v->count);
-+ v->s = PRS_ALLOC_MEM(ps,NETDFS_DFS_INFO1,v->count);
-+ if (!v->s)
-+ return False;
- }
- for (i_s_1=0; i_s_1<v->count;i_s_1++) {
- if (!netdfs_io_dfs_Info1_p("s", &v->s[i_s_1], ps, depth))
-@@ -986,7 +992,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->s = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->s)*v->count);
-+ v->s = PRS_ALLOC_MEM(ps,NETDFS_DFS_INFO2,v->count);
-+ if (!v->s)
-+ return False;
- }
- for (i_s_1=0; i_s_1<v->count;i_s_1++) {
- if (!netdfs_io_dfs_Info2_p("s", &v->s[i_s_1], ps, depth))
-@@ -1052,7 +1060,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->s = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->s)*v->count);
-+ v->s = PRS_ALLOC_MEM(ps,NETDFS_DFS_INFO3,v->count);
-+ if (!v->s)
-+ return False;
- }
- for (i_s_1=0; i_s_1<v->count;i_s_1++) {
- if (!netdfs_io_dfs_Info3_p("s", &v->s[i_s_1], ps, depth))
-@@ -1118,7 +1128,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->s = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->s)*v->count);
-+ v->s = PRS_ALLOC_MEM(ps,NETDFS_DFS_INFO4,v->count);
-+ if (!v->s)
-+ return False;
- }
- for (i_s_1=0; i_s_1<v->count;i_s_1++) {
- if (!netdfs_io_dfs_Info4_p("s", &v->s[i_s_1], ps, depth))
-@@ -1184,7 +1196,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->s = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->s)*v->count);
-+ v->s = PRS_ALLOC_MEM(ps,NETDFS_DFS_INFO200,v->count);
-+ if (!v->s)
-+ return False;
- }
- for (i_s_1=0; i_s_1<v->count;i_s_1++) {
- if (!netdfs_io_dfs_Info200_p("s", &v->s[i_s_1], ps, depth))
-@@ -1250,7 +1264,9 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- v->s = (void *)PRS_ALLOC_MEM_VOID(ps,sizeof(*v->s)*v->count);
-+ v->s = PRS_ALLOC_MEM(ps,NETDFS_DFS_INFO300,v->count);
-+ if (!v->s)
-+ return False;
- }
- for (i_s_1=0; i_s_1<v->count;i_s_1++) {
- if (!netdfs_io_dfs_Info300_p("s", &v->s[i_s_1], ps, depth))
-Index: samba-3.0.24/source/rpc_parse/parse_lsa.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_lsa.c 2007-02-04 12:59:22.000000000 -0600
-+++ samba-3.0.24/source/rpc_parse/parse_lsa.c 2007-05-25 12:41:06.000000000 -0500
-@@ -1171,7 +1171,7 @@
-
- /* Mallocate memory if we're unpacking from the wire */
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && sen->num_entries) {
- if ((sen->ptr_sid = PRS_ALLOC_MEM( ps, uint32, sen->num_entries)) == NULL) {
- DEBUG(3, ("init_lsa_sid_enum(): out of memory for "
- "ptr_sid\n"));
-@@ -1349,12 +1349,17 @@
- &trn->num_entries2))
- return False;
-
-- if (UNMARSHALLING(ps)) {
-- if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME, trn->num_entries)) == NULL) {
-+ if (trn->num_entries2 != trn->num_entries) {
-+ /* RPC fault */
-+ return False;
-+ }
-+
-+ if (UNMARSHALLING(ps) && trn->num_entries2) {
-+ if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME, trn->num_entries2)) == NULL) {
- return False;
- }
-
-- if ((trn->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, trn->num_entries)) == NULL) {
-+ if ((trn->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, trn->num_entries2)) == NULL) {
- return False;
- }
- }
-@@ -1406,12 +1411,17 @@
- &trn->num_entries2))
- return False;
-
-- if (UNMARSHALLING(ps)) {
-- if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME2, trn->num_entries)) == NULL) {
-+ if (trn->num_entries2 != trn->num_entries) {
-+ /* RPC fault */
-+ return False;
-+ }
-+
-+ if (UNMARSHALLING(ps) && trn->num_entries2) {
-+ if ((trn->name = PRS_ALLOC_MEM(ps, LSA_TRANS_NAME2, trn->num_entries2)) == NULL) {
- return False;
- }
-
-- if ((trn->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, trn->num_entries)) == NULL) {
-+ if ((trn->uni_name = PRS_ALLOC_MEM(ps, UNISTR2, trn->num_entries2)) == NULL) {
- return False;
- }
- }
-@@ -1678,7 +1688,7 @@
- return False;
- }
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && out->num_entries2) {
- if ((out->dom_rid = PRS_ALLOC_MEM(ps, DOM_RID, out->num_entries2))
- == NULL) {
- DEBUG(3, ("lsa_io_r_lookup_names(): out of memory\n"));
-@@ -1803,7 +1813,7 @@
- return False;
- }
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && out->num_entries2) {
- if ((out->dom_rid = PRS_ALLOC_MEM(ps, DOM_RID2, out->num_entries2))
- == NULL) {
- DEBUG(3, ("lsa_io_r_lookup_names2(): out of memory\n"));
-@@ -1956,7 +1966,7 @@
- return False;
- }
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && out->num_entries2) {
- if ((out->trans_sids = PRS_ALLOC_MEM(ps, LSA_TRANSLATED_SID3, out->num_entries2))
- == NULL) {
- DEBUG(3, ("lsa_io_r_lookup_names3(): out of memory\n"));
-@@ -2085,7 +2095,7 @@
- return False;
- }
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && out->num_entries2) {
- if ((out->trans_sids = PRS_ALLOC_MEM(ps, LSA_TRANSLATED_SID3, out->num_entries2))
- == NULL) {
- DEBUG(3, ("lsa_io_r_lookup_names4(): out of memory\n"));
-@@ -2324,7 +2334,7 @@
- if(!prs_uint32("count1", ps, depth, &out->count1))
- return False;
-
-- if (UNMARSHALLING(ps))
-+ if (UNMARSHALLING(ps) && out->count1)
- if (!(out->privs = PRS_ALLOC_MEM(ps, LSA_PRIV_ENTRY, out->count1)))
- return False;
-
-@@ -2759,7 +2769,7 @@
-
- static BOOL lsa_io_privilege_set(const char *desc, PRIVILEGE_SET *out, prs_struct *ps, int depth)
- {
-- uint32 i;
-+ uint32 i, dummy;
-
- prs_debug(ps, depth, desc, "lsa_io_privilege_set");
- depth++;
-@@ -2767,7 +2777,7 @@
- if(!prs_align(ps))
- return False;
-
-- if(!prs_uint32("count", ps, depth, &out->count))
-+ if(!prs_uint32("count", ps, depth, &dummy))
- return False;
- if(!prs_uint32("control", ps, depth, &out->control))
- return False;
-@@ -3886,7 +3896,7 @@
- prs_debug(ps, depth, desc, "smb_io_lsa_data_buf");
- depth++;
-
-- if ( UNMARSHALLING(ps) ) {
-+ if ( UNMARSHALLING(ps) && length ) {
- if ( !(buf->data = PRS_ALLOC_MEM( ps, uint8, length )) )
- return False;
- }
-@@ -3900,7 +3910,7 @@
- if (!prs_uint32("length", ps, depth, &buf->length))
- return False;
-
-- if(!prs_uint8s(False, "data", ps, depth, buf->data, size))
-+ if(!prs_uint8s(False, "data", ps, depth, buf->data, length))
- return False;
-
- return True;
-Index: samba-3.0.24/source/rpc_parse/parse_prs.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_prs.c 2007-02-04 12:59:22.000000000 -0600
-+++ samba-3.0.24/source/rpc_parse/parse_prs.c 2007-05-25 12:41:06.000000000 -0500
-@@ -156,7 +156,7 @@
- {
- char *ret = NULL;
-
-- if (size) {
-+ if (size && count) {
- /* We can't call the type-safe version here. */
- ret = _talloc_zero_array(ps->mem_ctx, size, count, "parse_prs");
- }
-@@ -642,9 +642,13 @@
- return True;
-
- if (UNMARSHALLING(ps)) {
-- if ( !(*data = PRS_ALLOC_MEM_VOID(ps, data_size)) )
-- return False;
-- }
-+ if (data_size) {
-+ if ( !(*data = (void *)PRS_ALLOC_MEM(ps, char, data_size)) )
-+ return False;
-+ } else {
-+ *data = NULL;
-+ }
-+ }
-
- return prs_fn(name, ps, depth, *data);
- }
-@@ -1014,16 +1018,16 @@
- if (q == NULL)
- return False;
-
-+ /* If the string is empty, we don't have anything to stream */
-+ if (str->buf_len==0)
-+ return True;
-+
- if (UNMARSHALLING(ps)) {
- str->buffer = PRS_ALLOC_MEM(ps,uint16,str->buf_len);
- if (str->buffer == NULL)
- return False;
- }
-
-- /* If the string is empty, we don't have anything to stream */
-- if (str->buf_len==0)
-- return True;
--
- p = (char *)str->buffer;
-
- dbg_rw_punival(charmode, name, depth, ps, q, p, str->buf_len);
-@@ -1053,6 +1057,8 @@
- buf->buffer = PRS_ALLOC_MEM(ps, uint16, buf->buf_max_len);
- if ( buf->buffer == NULL )
- return False;
-+ } else {
-+ buf->buffer = NULL;
- }
- }
-
-@@ -1080,9 +1086,13 @@
- if (str->str_str_len > str->str_max_len) {
- return False;
- }
-- str->buffer = PRS_ALLOC_MEM(ps,unsigned char, str->str_max_len);
-- if (str->buffer == NULL)
-- return False;
-+ if (str->str_max_len) {
-+ str->buffer = PRS_ALLOC_MEM(ps,unsigned char, str->str_max_len);
-+ if (str->buffer == NULL)
-+ return False;
-+ } else {
-+ str->buffer = NULL;
-+ }
- }
-
- if (UNMARSHALLING(ps)) {
-@@ -1127,9 +1137,13 @@
- if (str->uni_str_len > str->uni_max_len) {
- return False;
- }
-- str->buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_max_len);
-- if (str->buffer == NULL)
-- return False;
-+ if (str->uni_max_len) {
-+ str->buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_max_len);
-+ if (str->buffer == NULL)
-+ return False;
-+ } else {
-+ str->buffer = NULL;
-+ }
- }
-
- p = (char *)str->buffer;
-@@ -1154,9 +1168,13 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- str->str.buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_str_len);
-- if (str->str.buffer == NULL)
-- return False;
-+ if (str->uni_str_len) {
-+ str->str.buffer = PRS_ALLOC_MEM(ps,uint16,str->uni_str_len);
-+ if (str->str.buffer == NULL)
-+ return False;
-+ } else {
-+ str->str.buffer = NULL;
-+ }
- }
-
- p = (char *)str->str.buffer;
-Index: samba-3.0.24/source/rpc_parse/parse_sec.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_sec.c 2005-04-18 11:38:20.000000000 -0500
-+++ samba-3.0.24/source/rpc_parse/parse_sec.c 2007-05-25 12:40:05.000000000 -0500
-@@ -122,7 +122,7 @@
- for you as it reads them.
- ********************************************************************/
-
--BOOL sec_io_acl(const char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
-+static BOOL sec_io_acl(const char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth)
- {
- unsigned int i;
- uint32 old_offset;
-@@ -165,13 +165,10 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- /*
-- * Even if the num_aces is zero, allocate memory as there's a difference
-- * between a non-present DACL (allow all access) and a DACL with no ACE's
-- * (allow no access).
-- */
-- if((psa->ace = PRS_ALLOC_MEM(ps, SEC_ACE, psa->num_aces+1)) == NULL)
-- return False;
-+ if (psa->num_aces) {
-+ if((psa->ace = PRS_ALLOC_MEM(ps, SEC_ACE, psa->num_aces)) == NULL)
-+ return False;
-+ }
- }
-
- for (i = 0; i < psa->num_aces; i++) {
-Index: samba-3.0.24/source/rpc_parse/parse_spoolss.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_spoolss.c 2007-02-04 12:59:22.000000000 -0600
-+++ samba-3.0.24/source/rpc_parse/parse_spoolss.c 2007-05-25 12:41:06.000000000 -0500
-@@ -227,8 +227,13 @@
- if(!prs_uint32("count2", ps, depth, &type->count2))
- return False;
-
-- if (type->count2 != type->count)
-+ if (type->count2 != type->count) {
- DEBUG(4,("What a mess, count was %x now is %x !\n", type->count, type->count2));
-+ return False;
-+ }
-+ if (type->count2 > MAX_NOTIFY_TYPE_FOR_NOW) {
-+ return False;
-+ }
-
- /* parse the option type data */
- for(i=0;i<type->count2;i++)
-@@ -252,7 +257,7 @@
- return False;
-
- /* reading */
-- if (UNMARSHALLING(ps))
-+ if (UNMARSHALLING(ps) && ctr->count)
- if((ctr->type=PRS_ALLOC_MEM(ps,SPOOL_NOTIFY_OPTION_TYPE,ctr->count)) == NULL)
- return False;
-
-@@ -411,7 +416,7 @@
- if(!prs_uint32("string length", ps, depth, &data->notify_data.data.length))
- return False;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && data->notify_data.data.length) {
- data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16,
- data->notify_data.data.length);
-
-@@ -430,7 +435,7 @@
-
- case NOTIFY_POINTER:
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && data->notify_data.data.length) {
- data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16,
- data->notify_data.data.length);
-
-@@ -490,9 +495,13 @@
-
- /* Tallocate memory for string */
-
-- data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16, x * 2);
-- if (!data->notify_data.data.string)
-- return False;
-+ if (x) {
-+ data->notify_data.data.string = PRS_ALLOC_MEM(ps, uint16, x * 2);
-+ if (!data->notify_data.data.string)
-+ return False;
-+ } else {
-+ data->notify_data.data.string = NULL;
-+ }
-
- if(!prs_uint16uni(True,"string",ps,depth,data->notify_data.data.string,x))
- return False;
-@@ -5931,14 +5940,14 @@
- case REG_BINARY:
- case REG_DWORD:
- case REG_MULTI_SZ:
-- if (q_u->max_len) {
-- if (UNMARSHALLING(ps))
-- q_u->data=PRS_ALLOC_MEM(ps, uint8, q_u->max_len);
-- if(q_u->data == NULL)
-- return False;
-- if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))
-- return False;
-- }
-+ if (q_u->max_len) {
-+ if (UNMARSHALLING(ps))
-+ q_u->data=PRS_ALLOC_MEM(ps, uint8, q_u->max_len);
-+ if(q_u->data == NULL)
-+ return False;
-+ if(!prs_uint8s(False,"data", ps, depth, q_u->data, q_u->max_len))
-+ return False;
-+ }
- if(!prs_align(ps))
- return False;
- break;
-@@ -6956,7 +6965,7 @@
-
- /* first loop to write basic enum_value information */
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && ctr->size_of_array) {
- ctr->values = PRS_ALLOC_MEM(ps, PRINTER_ENUM_VALUES, ctr->size_of_array);
- if (!ctr->values)
- return False;
-Index: samba-3.0.24/source/libads/authdata.c
-===================================================================
---- samba-3.0.24.orig/source/libads/authdata.c 2006-02-23 10:29:34.000000000 -0600
-+++ samba-3.0.24/source/libads/authdata.c 2007-05-25 12:41:06.000000000 -0500
-@@ -120,10 +120,14 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- array->krb_sid_and_attrs = PRS_ALLOC_MEM(ps, KRB_SID_AND_ATTRS, num);
-- if (!array->krb_sid_and_attrs) {
-- DEBUG(3, ("No memory available\n"));
-- return False;
-+ if (num) {
-+ array->krb_sid_and_attrs = PRS_ALLOC_MEM(ps, KRB_SID_AND_ATTRS, num);
-+ if (!array->krb_sid_and_attrs) {
-+ DEBUG(3, ("No memory available\n"));
-+ return False;
-+ }
-+ } else {
-+ array->krb_sid_and_attrs = NULL;
- }
- }
-
-@@ -184,10 +188,14 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- array->group_membership = PRS_ALLOC_MEM(ps, GROUP_MEMBERSHIP, num);
-- if (!array->group_membership) {
-- DEBUG(3, ("No memory available\n"));
-- return False;
-+ if (num) {
-+ array->group_membership = PRS_ALLOC_MEM(ps, GROUP_MEMBERSHIP, num);
-+ if (!array->group_membership) {
-+ DEBUG(3, ("No memory available\n"));
-+ return False;
-+ }
-+ } else {
-+ array->group_membership = NULL;
- }
- }
-
-@@ -456,10 +464,14 @@
- return False;
-
- if (UNMARSHALLING(ps) && length) {
-- data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, siglen);
-- if (!data->signature.buffer) {
-- DEBUG(3, ("No memory available\n"));
-- return False;
-+ if (siglen) {
-+ data->signature.buffer = PRS_ALLOC_MEM(ps, uint8, siglen);
-+ if (!data->signature.buffer) {
-+ DEBUG(3, ("No memory available\n"));
-+ return False;
-+ }
-+ } else {
-+ data->signature.buffer = NULL;
- }
- }
-
-Index: samba-3.0.24/source/registry/regfio.c
-===================================================================
---- samba-3.0.24.orig/source/registry/regfio.c 2007-02-04 12:59:26.000000000 -0600
-+++ samba-3.0.24/source/registry/regfio.c 2007-05-25 12:41:06.000000000 -0500
-@@ -642,8 +642,12 @@
- return False;
-
- if ( UNMARSHALLING(&hbin->ps) ) {
-- if ( !(lf->hashes = PRS_ALLOC_MEM( &hbin->ps, REGF_HASH_REC, lf->num_keys )) )
-- return False;
-+ if (lf->num_keys) {
-+ if ( !(lf->hashes = PRS_ALLOC_MEM( &hbin->ps, REGF_HASH_REC, lf->num_keys )) )
-+ return False;
-+ } else {
-+ lf->hashes = NULL;
-+ }
- }
-
- for ( i=0; i<lf->num_keys; i++ ) {
-Index: samba-3.0.24/source/rpc_parse/parse_net.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_net.c 2007-02-04 12:59:22.000000000 -0600
-+++ samba-3.0.24/source/rpc_parse/parse_net.c 2007-05-25 12:41:06.000000000 -0500
-@@ -1721,9 +1721,13 @@
- }
-
- if (UNMARSHALLING(ps)) {
-- usr->gids = PRS_ALLOC_MEM(ps, DOM_GID, usr->num_groups);
-- if (usr->gids == NULL)
-- return False;
-+ if (usr->num_groups) {
-+ usr->gids = PRS_ALLOC_MEM(ps, DOM_GID, usr->num_groups);
-+ if (usr->gids == NULL)
-+ return False;
-+ } else {
-+ usr->gids = NULL;
-+ }
- }
-
- for (i = 0; i < usr->num_groups; i++) {
-@@ -1756,10 +1760,15 @@
- return False;
-
- if (UNMARSHALLING(ps)) {
-- usr->other_sids = PRS_ALLOC_MEM(ps, DOM_SID2, usr->num_other_sids);
-- usr->other_sids_attrib =
-- PRS_ALLOC_MEM(ps, uint32, usr->num_other_sids);
--
-+ if (usr->num_other_sids) {
-+ usr->other_sids = PRS_ALLOC_MEM(ps, DOM_SID2, usr->num_other_sids);
-+ usr->other_sids_attrib =
-+ PRS_ALLOC_MEM(ps, uint32, usr->num_other_sids);
-+ } else {
-+ usr->other_sids = NULL;
-+ usr->other_sids_attrib = NULL;
-+ }
-+
- if ((num_other_sids != 0) &&
- ((usr->other_sids == NULL) ||
- (usr->other_sids_attrib == NULL)))
-Index: samba-3.0.24/source/rpc_parse/parse_samr.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_samr.c 2007-02-04 12:59:22.000000000 -0600
-+++ samba-3.0.24/source/rpc_parse/parse_samr.c 2007-05-25 12:41:06.000000000 -0500
-@@ -3337,7 +3337,7 @@
- if(!prs_uint32("num_entries3", ps, depth, &r_u->num_entries3))
- return False;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && r_u->num_entries2) {
- r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2);
- r_u->uni_dom_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2);
- }
-@@ -3476,7 +3476,7 @@
- if(!prs_uint32("num_entries3", ps, depth, &r_u->num_entries3))
- return False;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && r_u->num_entries2) {
- r_u->sam = PRS_ALLOC_MEM(ps,SAM_ENTRY,r_u->num_entries2);
- r_u->uni_grp_name = PRS_ALLOC_MEM(ps,UNISTR2,r_u->num_entries2);
- }
-@@ -4980,12 +4980,13 @@
- return False;
- }
-
-- if (UNMARSHALLING(ps))
-+ if (UNMARSHALLING(ps) && r_u->num_rids2) {
- r_u->rids = PRS_ALLOC_MEM(ps, uint32, r_u->num_rids2);
-
-- if (!r_u->rids) {
-- DEBUG(0, ("NULL rids in samr_io_r_lookup_names\n"));
-- return False;
-+ if (!r_u->rids) {
-+ DEBUG(0, ("NULL rids in samr_io_r_lookup_names\n"));
-+ return False;
-+ }
- }
-
- for (i = 0; i < r_u->num_rids2; i++) {
-@@ -5009,12 +5010,13 @@
- return False;
- }
-
-- if (UNMARSHALLING(ps))
-+ if (UNMARSHALLING(ps) && r_u->num_types2) {
- r_u->types = PRS_ALLOC_MEM(ps, uint32, r_u->num_types2);
-
-- if (!r_u->types) {
-- DEBUG(0, ("NULL types in samr_io_r_lookup_names\n"));
-- return False;
-+ if (!r_u->types) {
-+ DEBUG(0, ("NULL types in samr_io_r_lookup_names\n"));
-+ return False;
-+ }
- }
-
- for (i = 0; i < r_u->num_types2; i++) {
-Index: samba-3.0.24/source/rpc_parse/parse_srv.c
-===================================================================
---- samba-3.0.24.orig/source/rpc_parse/parse_srv.c 2005-04-18 11:38:20.000000000 -0500
-+++ samba-3.0.24/source/rpc_parse/parse_srv.c 2007-05-25 12:41:06.000000000 -0500
-@@ -782,7 +782,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info0 = PRS_ALLOC_MEM(ps, SRV_SHARE_INFO_0, num_entries)))
- return False;
- ctr->share.info0 = info0;
-@@ -808,7 +808,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info1 = PRS_ALLOC_MEM(ps, SRV_SHARE_INFO_1, num_entries)))
- return False;
- ctr->share.info1 = info1;
-@@ -834,7 +834,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info2 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_2,num_entries)))
- return False;
- ctr->share.info2 = info2;
-@@ -859,7 +859,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info501 = PRS_ALLOC_MEM(ps, SRV_SHARE_INFO_501, num_entries)))
- return False;
- ctr->share.info501 = info501;
-@@ -884,7 +884,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info502 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_502,num_entries)))
- return False;
- ctr->share.info502 = info502;
-@@ -910,7 +910,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info1004 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1004,num_entries)))
- return False;
- ctr->share.info1004 = info1004;
-@@ -936,7 +936,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info1005 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1005,num_entries)))
- return False;
- ctr->share.info1005 = info1005;
-@@ -956,7 +956,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info1006 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1006,num_entries)))
- return False;
- ctr->share.info1006 = info1006;
-@@ -976,7 +976,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info1007 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1007,num_entries)))
- return False;
- ctr->share.info1007 = info1007;
-@@ -1002,7 +1002,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info1501 = PRS_ALLOC_MEM(ps,SRV_SHARE_INFO_1501,num_entries)))
- return False;
- ctr->share.info1501 = info1501;
-@@ -2558,7 +2558,7 @@
- int num_entries = ctr->num_entries;
- int i;
-
-- if (UNMARSHALLING(ps)) {
-+ if (UNMARSHALLING(ps) && num_entries) {
- if (!(info3 = PRS_ALLOC_MEM(ps, SRV_FILE_INFO_3, num_entries)))
- return False;
- ctr->file.info3 = info3;
-@@ -3377,7 +3377,7 @@
-
- r_n->disk_enum_ctr.entries_read = entries_read3;
-
-- if(UNMARSHALLING(ps)) {
-+ if(UNMARSHALLING(ps) && entries_read3) {
-
- DISK_INFO *dinfo;
-
-@@ -3386,7 +3386,7 @@
- r_n->disk_enum_ctr.disk_info = dinfo;
- }
-
-- for(i=0; i < r_n->disk_enum_ctr.entries_read; i++) {
-+ for(i=0; i < entries_read3; i++) {
-
- if(!prs_uint32("unknown", ps, depth, &r_n->disk_enum_ctr.disk_info[i].unknown))
- return False;
diff --git a/net-fs/samba/files/3.0.24-shell_escape.patch b/net-fs/samba/files/3.0.24-shell_escape.patch
deleted file mode 100644
index dc7fd94ebddd..000000000000
--- a/net-fs/samba/files/3.0.24-shell_escape.patch
+++ /dev/null
@@ -1,252 +0,0 @@
-Only in source-orig/: configure
-diff -u -r source-orig/lib/charcnv.c source/lib/charcnv.c
---- source-orig/lib/charcnv.c 2006-04-19 19:29:23.000000000 -0700
-+++ source/lib/charcnv.c 2007-05-10 09:59:49.023262000 -0700
-@@ -1398,5 +1398,5 @@
- /* We're hosed - we don't know how big this is... */
- DEBUG(10,("next_mb_char_size: unknown size at string %s\n", s));
- conv_silent = False;
-- return 1;
-+ return (size_t)-1;
- }
-diff -u -r source-orig/lib/smbrun.c source/lib/smbrun.c
---- source-orig/lib/smbrun.c 2006-04-19 19:29:23.000000000 -0700
-+++ source/lib/smbrun.c 2007-05-10 09:57:03.305061000 -0700
-@@ -55,7 +55,7 @@
- outfd (or discard it if outfd is NULL).
- ****************************************************************************/
-
--int smbrun(const char *cmd, int *outfd)
-+static int smbrun_internal(const char *cmd, int *outfd, BOOL sanitize)
- {
- pid_t pid;
- uid_t uid = current_user.ut.uid;
-@@ -173,13 +173,36 @@
- }
- #endif
-
-- execl("/bin/sh","sh","-c",cmd,NULL);
-+ {
-+ const char *newcmd = sanitize ? escape_shell_string(cmd) : cmd;
-+ if (!newcmd) {
-+ exit(82);
-+ }
-+ execl("/bin/sh","sh","-c",newcmd,NULL);
-+ }
-
- /* not reached */
-- exit(82);
-+ exit(83);
- return 1;
- }
-
-+/****************************************************************************
-+ Use only in known safe shell calls (printing).
-+****************************************************************************/
-+
-+int smbrun_no_sanitize(const char *cmd, int *outfd)
-+{
-+ return smbrun_internal(cmd, outfd, False);
-+}
-+
-+/****************************************************************************
-+ By default this now sanitizes shell expansion.
-+****************************************************************************/
-+
-+int smbrun(const char *cmd, int *outfd)
-+{
-+ return smbrun_internal(cmd, outfd, True);
-+}
-
- /****************************************************************************
- run a command being careful about uid/gid handling and putting the output in
-@@ -302,7 +325,7 @@
- #endif
-
- execl("/bin/sh", "sh", "-c", cmd, NULL);
--
-+
- /* not reached */
- exit(82);
- return 1;
-diff -u -r source-orig/lib/util_str.c source/lib/util_str.c
---- source-orig/lib/util_str.c 2007-02-04 10:59:17.000000000 -0800
-+++ source/lib/util_str.c 2007-05-10 09:59:36.718762000 -0700
-@@ -2426,3 +2426,165 @@
- return True;
- }
-
-+
-+/*******************************************************************
-+ Add a shell escape character '\' to any character not in a known list
-+ of characters. UNIX charset format.
-+*******************************************************************/
-+
-+#define INCLUDE_LIST "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabdefghijklmnopqrstuvwxyz_/ \t.,"
-+#define INSIDE_DQUOTE_LIST "$`\n\"\\"
-+
-+char *escape_shell_string(const char *src)
-+{
-+ size_t srclen = strlen(src);
-+ char *ret = SMB_MALLOC((srclen * 2) + 1);
-+ char *dest = ret;
-+ BOOL in_s_quote = False;
-+ BOOL in_d_quote = False;
-+ BOOL next_escaped = False;
-+
-+ if (!ret) {
-+ return NULL;
-+ }
-+
-+ while (*src) {
-+ size_t c_size = next_mb_char_size(src);
-+
-+ if (c_size == (size_t)-1) {
-+ SAFE_FREE(ret);
-+ return NULL;
-+ }
-+
-+ if (c_size > 1) {
-+ memcpy(dest, src, c_size);
-+ src += c_size;
-+ dest += c_size;
-+ next_escaped = False;
-+ continue;
-+ }
-+
-+ /*
-+ * Deal with backslash escaped state.
-+ * This only lasts for one character.
-+ */
-+
-+ if (next_escaped) {
-+ *dest++ = *src++;
-+ next_escaped = False;
-+ continue;
-+ }
-+
-+ /*
-+ * Deal with single quote state. The
-+ * only thing we care about is exiting
-+ * this state.
-+ */
-+
-+ if (in_s_quote) {
-+ if (*src == '\'') {
-+ in_s_quote = False;
-+ }
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ /*
-+ * Deal with double quote state. The most
-+ * complex state. We must cope with \, meaning
-+ * possibly escape next char (depending what it
-+ * is), ", meaning exit this state, and possibly
-+ * add an \ escape to any unprotected character
-+ * (listed in INSIDE_DQUOTE_LIST).
-+ */
-+
-+ if (in_d_quote) {
-+ if (*src == '\\') {
-+ /*
-+ * Next character might be escaped.
-+ * We have to peek. Inside double
-+ * quotes only INSIDE_DQUOTE_LIST
-+ * characters are escaped by a \.
-+ */
-+
-+ char nextchar;
-+
-+ c_size = next_mb_char_size(&src[1]);
-+ if (c_size == (size_t)-1) {
-+ SAFE_FREE(ret);
-+ return NULL;
-+ }
-+ if (c_size > 1) {
-+ /*
-+ * Don't escape the next char.
-+ * Just copy the \.
-+ */
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ nextchar = src[1];
-+
-+ if (nextchar && strchr(INSIDE_DQUOTE_LIST, (int)nextchar)) {
-+ next_escaped = True;
-+ }
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ if (*src == '\"') {
-+ /* Exit double quote state. */
-+ in_d_quote = False;
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ /*
-+ * We know the character isn't \ or ",
-+ * so escape it if it's any of the other
-+ * possible unprotected characters.
-+ */
-+
-+ if (strchr(INSIDE_DQUOTE_LIST, (int)*src)) {
-+ *dest++ = '\\';
-+ }
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ /*
-+ * From here to the end of the loop we're
-+ * not in the single or double quote state.
-+ */
-+
-+ if (*src == '\\') {
-+ /* Next character must be escaped. */
-+ next_escaped = True;
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ if (*src == '\'') {
-+ /* Go into single quote state. */
-+ in_s_quote = True;
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ if (*src == '\"') {
-+ /* Go into double quote state. */
-+ in_d_quote = True;
-+ *dest++ = *src++;
-+ continue;
-+ }
-+
-+ /* Check if we need to escape the character. */
-+
-+ if (!strchr(INCLUDE_LIST, (int)*src)) {
-+ *dest++ = '\\';
-+ }
-+ *dest++ = *src++;
-+ }
-+ *dest++ = '\0';
-+ return ret;
-+}
-diff -u -r source-orig/printing/print_generic.c source/printing/print_generic.c
---- source-orig/printing/print_generic.c 2007-02-04 10:59:13.000000000 -0800
-+++ source/printing/print_generic.c 2007-05-10 09:57:03.292061000 -0700
-@@ -58,7 +58,7 @@
- if ( do_sub && snum != -1 )
- standard_sub_snum(snum,syscmd,sizeof(syscmd));
-
-- ret = smbrun(syscmd,outfd);
-+ ret = smbrun_no_sanitize(syscmd,outfd);
-
- DEBUG(3,("Running the command `%s' gave %d\n",syscmd,ret));
-
diff --git a/net-fs/samba/files/3.0.24-sid2name_elevation_v2.patch b/net-fs/samba/files/3.0.24-sid2name_elevation_v2.patch
deleted file mode 100644
index 7bf5a1a4ca04..000000000000
--- a/net-fs/samba/files/3.0.24-sid2name_elevation_v2.patch
+++ /dev/null
@@ -1,168 +0,0 @@
-Index: samba-3.0.24/source/lib/util_sec.c
-===================================================================
---- samba-3.0.24.orig/source/lib/util_sec.c 2007-05-25 12:36:10.000000000 -0500
-+++ samba-3.0.24/source/lib/util_sec.c 2007-05-25 12:36:38.000000000 -0500
-@@ -286,28 +286,6 @@
- }
-
- /****************************************************************************
-- Lightweight become root - no group change.
--****************************************************************************/
--
--void become_root_uid_only(void)
--{
-- save_re_uid();
-- set_effective_uid(0);
--}
--
--/****************************************************************************
-- Lightweight unbecome root - no group change. Expects we are root already,
-- saves errno across call boundary.
--****************************************************************************/
--
--void unbecome_root_uid_only(void)
--{
-- int saved_errno = errno;
-- restore_re_uid_fromroot();
-- errno = saved_errno;
--}
--
--/****************************************************************************
- save the real and effective gid for later restoration. Used by the
- getgroups code
- ****************************************************************************/
-Index: samba-3.0.24/source/passdb/lookup_sid.c
-===================================================================
---- samba-3.0.24.orig/source/passdb/lookup_sid.c 2007-05-25 12:36:10.000000000 -0500
-+++ samba-3.0.24/source/passdb/lookup_sid.c 2007-05-25 12:36:38.000000000 -0500
-@@ -421,10 +421,10 @@
- return False;
- }
-
-- become_root_uid_only();
-+ become_root();
- result = pdb_lookup_rids(domain_sid, num_rids, rids,
- *names, *types);
-- unbecome_root_uid_only();
-+ unbecome_root();
-
- return (NT_STATUS_IS_OK(result) ||
- NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) ||
-@@ -1085,9 +1085,9 @@
- goto done;
- }
-
-- become_root_uid_only();
-+ become_root();
- ret = pdb_uid_to_rid(uid, &rid);
-- unbecome_root_uid_only();
-+ unbecome_root();
-
- if (ret) {
- /* This is a mapped user */
-@@ -1131,9 +1131,9 @@
- goto done;
- }
-
-- become_root_uid_only();
-+ become_root();
- ret = pdb_gid_to_sid(gid, psid);
-- unbecome_root_uid_only();
-+ unbecome_root();
-
- if (ret) {
- /* This is a mapped group */
-@@ -1179,9 +1179,9 @@
- union unid_t id;
- BOOL ret;
-
-- become_root_uid_only();
-+ become_root();
- ret = pdb_sid_to_id(psid, &id, &type);
-- unbecome_root_uid_only();
-+ unbecome_root();
-
- if (ret) {
- if (type != SID_NAME_USER) {
-@@ -1259,9 +1259,9 @@
- sid_check_is_in_wellknown_domain(psid))) {
- BOOL ret;
-
-- become_root_uid_only();
-+ become_root();
- ret = pdb_getgrsid(&map, *psid);
-- unbecome_root_uid_only();
-+ unbecome_root();
-
- if (ret) {
- *pgid = map.gid;
-@@ -1273,9 +1273,9 @@
- if (sid_peek_check_rid(get_global_sam_sid(), psid, &rid)) {
- BOOL ret;
-
-- become_root_uid_only();
-+ become_root();
- ret = pdb_sid_to_id(psid, &id, &type);
-- unbecome_root_uid_only();
-+ unbecome_root();
-
- if (ret) {
- if ((type != SID_NAME_DOM_GRP) &&
-Index: samba-3.0.24/source/smbd/uid.c
-===================================================================
---- samba-3.0.24.orig/source/smbd/uid.c 2007-05-25 12:36:28.000000000 -0500
-+++ samba-3.0.24/source/smbd/uid.c 2007-05-25 12:36:46.000000000 -0500
-@@ -151,7 +151,9 @@
- char group_c;
- BOOL must_free_token = False;
- NT_USER_TOKEN *token = NULL;
--
-+ int num_groups = 0;
-+ gid_t *group_list = NULL;
-+
- if (!conn) {
- DEBUG(2,("change_to_user: Connection not open\n"));
- return(False);
-@@ -190,14 +192,14 @@
- if (conn->force_user) /* security = share sets this too */ {
- uid = conn->uid;
- gid = conn->gid;
-- current_user.ut.groups = conn->groups;
-- current_user.ut.ngroups = conn->ngroups;
-+ group_list = conn->groups;
-+ num_groups = conn->ngroups;
- token = conn->nt_user_token;
- } else if (vuser) {
- uid = conn->admin_user ? 0 : vuser->uid;
- gid = vuser->gid;
-- current_user.ut.ngroups = vuser->n_groups;
-- current_user.ut.groups = vuser->groups;
-+ num_groups = vuser->n_groups;
-+ group_list = vuser->groups;
- token = vuser->nt_user_token;
- } else {
- DEBUG(2,("change_to_user: Invalid vuid used %d in accessing "
-@@ -230,8 +232,8 @@
- */
-
- int i;
-- for (i = 0; i < current_user.ut.ngroups; i++) {
-- if (current_user.ut.groups[i] == conn->gid) {
-+ for (i = 0; i < num_groups; i++) {
-+ if (group_list[i] == conn->gid) {
- gid = conn->gid;
- gid_to_sid(&token->user_sids[1], gid);
- break;
-@@ -243,6 +245,12 @@
- }
- }
-
-+ /* Now set current_user since we will immediately also call
-+ set_sec_ctx() */
-+
-+ current_user.ut.ngroups = num_groups;
-+ current_user.ut.groups = group_list;
-+
- set_sec_ctx(uid, gid, current_user.ut.ngroups, current_user.ut.groups,
- token);
-