diff options
| author | Volker Lendecke <vl@samba.org> | 2013-11-10 11:48:17 +0100 |
|---|---|---|
| committer | Ira Cooper <ira@samba.org> | 2013-11-11 21:04:09 +0100 |
| commit | ea83ac6b0142e99b514f7c4a3a4b038c2e409a8d (patch) | |
| tree | d599af43141671f79cd55071150c85a226026142 /source3/modules | |
| parent | df8dff7dd27459dad337e66f3e2f75c47e28cc8c (diff) | |
| download | samba-ea83ac6b0142e99b514f7c4a3a4b038c2e409a8d.tar.gz samba-ea83ac6b0142e99b514f7c4a3a4b038c2e409a8d.tar.xz samba-ea83ac6b0142e99b514f7c4a3a4b038c2e409a8d.zip | |
smbd: Fix CID 1035478 Negative array index read
lp_parm_enum can return -1. Add error checking.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ira Cooper <ira@samba.org>
Diffstat (limited to 'source3/modules')
| -rw-r--r-- | source3/modules/nfs4_acls.c | 25 |
1 files changed, 19 insertions, 6 deletions
diff --git a/source3/modules/nfs4_acls.c b/source3/modules/nfs4_acls.c index 08ae141158..774c40e269 100644 --- a/source3/modules/nfs4_acls.c +++ b/source3/modules/nfs4_acls.c @@ -85,16 +85,29 @@ static int smbacl4_get_vfs_params( { e_merge, "merge" }, { -1 , NULL } }; + int enumval; memset(params, 0, sizeof(smbacl4_vfs_params)); - params->mode = (enum smbacl4_mode_enum)lp_parm_enum( - SNUM(conn), type_name, - "mode", enum_smbacl4_modes, e_simple); + + enumval = lp_parm_enum(SNUM(conn), type_name, "mode", + enum_smbacl4_modes, e_simple); + if (enumval == -1) { + DEBUG(10, ("value for %s:mode unknown\n", type_name)); + return -1; + } + params->mode = (enum smbacl4_mode_enum)enumval; + params->do_chown = lp_parm_bool(SNUM(conn), type_name, "chown", true); - params->acedup = (enum smbacl4_acedup_enum)lp_parm_enum( - SNUM(conn), type_name, - "acedup", enum_smbacl4_acedups, e_dontcare); + + enumval = lp_parm_enum(SNUM(conn), type_name, "acedup", + enum_smbacl4_acedups, e_dontcare); + if (enumval == -1) { + DEBUG(10, ("value for %s:acedup unknown\n", type_name)); + return -1; + } + params->acedup = (enum smbacl4_acedup_enum)enumval; + params->map_full_control = lp_acl_map_full_control(SNUM(conn)); DEBUG(10, ("mode:%s, do_chown:%s, acedup: %s map full control:%s\n", |