usr/src/cmd/samba/login_cache-diff
author Cyril Plisko <cyril.plisko@grigale.com>
Sat, 26 Jun 2010 23:31:21 -0700
changeset 17 4c6e1d5e1470
parent 16 4481d72bca2d
permissions -rw-r--r--
Import sfw build 143 Bugs Fixed ---------- 6934319 Update gnuplot to version 4.4 6960032 update gocr to newer version 6961961 CVE-2010-2063 in Samba 3.3.x and below, a buffer overrun is possible in chain_reply code. 6962388 Wireshark update to version 1.2.9

--- samba-3.0.37/source/passdb/login_cache.c	Thu Mar 11 04:54:39 2010
+++ samba-3.0.37-new/source/passdb/login_cache.c	Wed Mar 17 04:37:18 2010
@@ -68,6 +68,7 @@
 {
 	TDB_DATA keybuf, databuf;
 	LOGIN_CACHE *entry;
+	uint16_t acct_ctrl;
 
 	if (!login_cache_init())
 		return NULL;
@@ -95,7 +96,7 @@
 	}
 
 	if (tdb_unpack (databuf.dptr, databuf.dsize, SAM_CACHE_FORMAT,
-			&entry->entry_timestamp, &entry->acct_ctrl, 
+			&entry->entry_timestamp, &acct_ctrl, 
 			&entry->bad_password_count, 
 			&entry->bad_password_time) == -1) {
 		DEBUG(7, ("No cache entry found\n"));
@@ -106,6 +107,12 @@
 
 	SAFE_FREE(databuf.dptr);
 
+	/*
+	 * Deal with 32-bit acct_ctrl. In the tdb we only store 16-bit
+	 * ("w" in SAM_CACHE_FORMAT). Fixes bug 7253.
+	 */
+	entry->acct_ctrl = acct_ctrl;
+
 	DEBUG(5, ("Found login cache entry: timestamp %12u, flags 0x%x, count %d, time %12u\n",
 		  (unsigned int)entry->entry_timestamp, entry->acct_ctrl, 
 		  entry->bad_password_count, (unsigned int)entry->bad_password_time));