Attachment 294297 Details for Bug 431960 – patch backported to RHEL 4.6

[patch] patch backported to RHEL 4.6

samba-3.0.28-notify-nomem.patch (text/plain), 4.40 KB, created by David Robinson on 2008-02-08 01:53:41 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: David Robinson

Created: 2008-02-08 01:53:41 UTC

Size: 4.40 KB

patch

obsolete

>--- samba-3.0.25b/source/smbd/notify.c.orig	2008-02-02 13:01:16.000000000 +1000
>+++ samba-3.0.25b/source/smbd/notify.c	2008-02-02 14:31:52.000000000 +1000
>@@ -22,15 +22,12 @@
> 
> #include "includes.h"
> 
>-/* Max size we can send to client in a notify response. */
>-extern int max_send;
>-
> struct notify_change_request {
> 	struct notify_change_request *prev, *next;
> 	struct files_struct *fsp;	/* backpointer for cancel by mid */
> 	char request_buf[smb_size];
> 	uint32 filter;
>-	uint32 current_bufsize;
>+	uint32 max_param;
> 	struct notify_mid_map *mid_map;
> 	void *backend_data;
> };
>@@ -50,19 +47,40 @@
> 	uint16 mid;
> };
> 
>+static BOOL notify_change_record_identical(struct notify_change *c1,
>+					struct notify_change *c2)
>+{
>+	/* Note this is deliberately case sensitive. */
>+	if (c1->action == c2->action &&
>+			strcmp(c1->name, c2->name) == 0) {
>+		return True;
>+	}
>+	return False;
>+}
>+
> static BOOL notify_marshall_changes(int num_changes,
>-				    struct notify_change *changes,
>-				    prs_struct *ps)
>+				uint32 max_offset,
>+				struct notify_change *changes,
>+				prs_struct *ps)
> {
> 	int i;
> 	UNISTR uni_name;
> 
> 	for (i=0; i<num_changes; i++) {
>-		struct notify_change *c = &changes[i];
>+		struct notify_change *c;
> 		size_t namelen;
> 		uint32 u32_tmp;	/* Temp arg to prs_uint32 to avoid
> 				 * signed/unsigned issues */
> 
>+		/* Coalesce any identical records. */
>+		while (i+1 < num_changes &&
>+			notify_change_record_identical(&changes[i],
>+						&changes[i+1])) {
>+			i++;
>+		}
>+
>+		c = &changes[i];
>+
> 		namelen = convert_string_allocate(
> 			NULL, CH_UNIX, CH_UTF16LE, c->name, strlen(c->name)+1,
> 			&uni_name.buffer, True);
>@@ -93,6 +111,11 @@
> 		prs_set_offset(ps, prs_offset(ps)-2);
> 
> 		SAFE_FREE(uni_name.buffer);
>+
>+		if (prs_offset(ps) > max_offset) {
>+			/* Too much data for client. */
>+			return False;
>+		}
> 	}
> 
> 	return True;
>@@ -128,7 +151,7 @@
> 				    "failed.");
> }
> 
>-void change_notify_reply(const char *request_buf,
>+void change_notify_reply(const char *request_buf, uint32 max_param,
> 			 struct notify_change_buf *notify_buf)
> {
> 	char *outbuf = NULL;
>@@ -137,19 +160,14 @@
> 
> 	if (notify_buf->num_changes == -1) {
> 		change_notify_reply_packet(request_buf, NT_STATUS_OK);
>+		notify_buf->num_changes = 0;
> 		return;
> 	}
> 
>-	if (!prs_init(&ps, 0, NULL, False)
>-	    || !notify_marshall_changes(notify_buf->num_changes,
>-					notify_buf->changes, &ps)) {
>-		change_notify_reply_packet(request_buf, NT_STATUS_NO_MEMORY);
>-		goto done;
>-	}
>-
>-	buflen = smb_size+38+prs_offset(&ps) + 4 /* padding */;
>+	prs_init(&ps, 0, NULL, MARSHALL);
> 
>-	if (buflen > max_send) {
>+	if (!notify_marshall_changes(notify_buf->num_changes, max_param,
>+					notify_buf->changes, &ps)) {
> 		/*
> 		 * We exceed what the client is willing to accept. Send
> 		 * nothing.
>@@ -158,6 +176,8 @@
> 		goto done;
> 	}
> 
>+	buflen = smb_size+38+prs_offset(&ps) + 4 /* padding */;
>+
> 	if (!(outbuf = SMB_MALLOC_ARRAY(char, buflen))) {
> 		change_notify_reply_packet(request_buf, NT_STATUS_NO_MEMORY);
> 		goto done;
>@@ -218,7 +238,7 @@
> 	return status;
> }
> 
>-NTSTATUS change_notify_add_request(const char *inbuf, 
>+NTSTATUS change_notify_add_request(const char *inbuf, uint32 max_param,
> 				   uint32 filter, BOOL recursive,
> 				   struct files_struct *fsp)
> {
>@@ -235,11 +255,11 @@
> 	map->req = request;
> 
> 	memcpy(request->request_buf, inbuf, sizeof(request->request_buf));
>-	request->current_bufsize = 0;
>+	request->max_param = max_param;
> 	request->filter = filter;
> 	request->fsp = fsp;
> 	request->backend_data = NULL;
>-	
>+
> 	DLIST_ADD_END(fsp->notify->requests, request,
> 		      struct notify_change_request *);
> 
>@@ -411,6 +431,7 @@
> 	 */
> 
> 	change_notify_reply(fsp->notify->requests->request_buf,
>+			    fsp->notify->requests->max_param,
> 			    fsp->notify);
> 
> 	change_notify_remove_request(fsp->notify->requests);
>--- samba-3.0.25b/source/smbd/nttrans.c.orig	2008-02-02 14:54:11.000000000 +1000
>+++ samba-3.0.25b/source/smbd/nttrans.c	2008-02-02 14:55:34.000000000 +1000
>@@ -1979,7 +1979,7 @@
> 		 * here.
> 		 */
> 
>-		change_notify_reply(inbuf, fsp->notify);
>+		change_notify_reply(inbuf, max_param_count, fsp->notify);
> 
> 		/*
> 		 * change_notify_reply() above has independently sent its
>@@ -1992,7 +1992,8 @@
> 	 * No changes pending, queue the request
> 	 */
> 
>-	status = change_notify_add_request(inbuf, filter, recursive, fsp);
>+	status = change_notify_add_request(inbuf, max_param_count, filter,
>+			recursive, fsp);
> 	if (!NT_STATUS_IS_OK(status)) {
> 		return ERROR_NT(status);
> 	}

Actions: View | Diff

Attachments on bug 431960: 294297