Dimitry Andric
ddfe6ae2fc
With recent versions of clang, samba could dump core shortly after startup, terminating with either SIGILL or SIGSEGV. Investigation showed that samba is using C99 variable length arrays (VLAs), and in some cases the length of these arrays would become zero. Since this is undefined behavior, various interesting things would happen, often ending in segfaults. Fix this by avoiding to use zero as the length for these VLA declarations. A similar patch was also sent upstream, and was accepted and included in subsequent samba releases. See also: https://bugzilla.samba.org/show_bug.cgi?id=14605 Reported by: Dries Michiels <driesm.michiels@gmail.com> PR: 252157 MFH: 2021Q1
30 lines
823 B
C
30 lines
823 B
C
--- source3/lib/messages.c.orig 2020-07-09 09:33:56 UTC
|
|
+++ source3/lib/messages.c
|
|
@@ -157,7 +157,7 @@ struct messaging_rec *messaging_rec_create(
|
|
|
|
{
|
|
struct messaging_rec rec;
|
|
- int64_t fds64[num_fds];
|
|
+ int64_t fds64[MAX(1, num_fds)];
|
|
size_t i;
|
|
|
|
for (i=0; i<num_fds; i++) {
|
|
@@ -391,7 +391,7 @@ static void messaging_recv_cb(struct tevent_context *e
|
|
private_data, struct messaging_context);
|
|
struct server_id_buf idbuf;
|
|
struct messaging_rec rec;
|
|
- int64_t fds64[MIN(num_fds, INT8_MAX)];
|
|
+ int64_t fds64[MAX(1, MIN(num_fds, INT8_MAX))];
|
|
size_t i;
|
|
|
|
if (msg_len < MESSAGE_HDR_LENGTH) {
|
|
@@ -1371,7 +1371,7 @@ static void messaging_dispatch_rec(struct messaging_co
|
|
|
|
if (ev != msg_ctx->event_ctx) {
|
|
struct iovec iov;
|
|
- int fds[rec->num_fds];
|
|
+ int fds[MAX(1, rec->num_fds)];
|
|
int ret;
|
|
|
|
/*
|