libcli:smb2: Use talloc NULL context if we don't have a stackframe
authorAndreas Schneider <asn@samba.org>
Mon, 13 Jul 2020 15:23:37 +0000 (17:23 +0200)
committerAndreas Schneider <asn@cryptomilk.org>
Wed, 19 Aug 2020 16:22:40 +0000 (16:22 +0000)
If we execute this code from python we don't have a talloc stackframe
around and segfault with talloc_tos().

To fix the crash we use the NULL context as we take care for freeing the
memory as soon as possible.

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
libcli/smb/smb2_signing.c

index bba80817018b8ba2d4b961a6f2a5936aea090de4..7669b219bbe528a358be54a5fbfb8b0d693039d0 100644 (file)
@@ -513,14 +513,25 @@ NTSTATUS smb2_signing_encrypt_pdu(struct smb2_signing_key *encryption_key,
                uint8_t *ctext = NULL;
                size_t len = 0;
                int i;
+               TALLOC_CTX *tmp_ctx = NULL;
 
-               ptext = talloc_size(talloc_tos(), ptext_size);
+               /*
+                * If we come from python bindings, we don't have a stackframe
+                * around, so use the NULL context.
+                *
+                * This is fine as we make sure we free the memory.
+                */
+               if (talloc_stackframe_exists()) {
+                       tmp_ctx = talloc_tos();
+               }
+
+               ptext = talloc_size(tmp_ctx, ptext_size);
                if (ptext == NULL) {
                        status = NT_STATUS_NO_MEMORY;
                        goto out;
                }
 
-               ctext = talloc_size(talloc_tos(), ctext_size);
+               ctext = talloc_size(tmp_ctx, ctext_size);
                if (ctext == NULL) {
                        TALLOC_FREE(ptext);
                        status = NT_STATUS_NO_MEMORY;
@@ -713,16 +724,27 @@ NTSTATUS smb2_signing_decrypt_pdu(struct smb2_signing_key *decryption_key,
                uint8_t *ptext = NULL;
                size_t len = 0;
                int i;
+               TALLOC_CTX *tmp_ctx = NULL;
+
+               /*
+                * If we come from python bindings, we don't have a stackframe
+                * around, so use the NULL context.
+                *
+                * This is fine as we make sure we free the memory.
+                */
+               if (talloc_stackframe_exists()) {
+                       tmp_ctx = talloc_tos();
+               }
 
                /* GnuTLS doesn't have a iovec API for decryption yet */
 
-               ptext = talloc_size(talloc_tos(), ptext_size);
+               ptext = talloc_size(tmp_ctx, ptext_size);
                if (ptext == NULL) {
                        status = NT_STATUS_NO_MEMORY;
                        goto out;
                }
 
-               ctext = talloc_size(talloc_tos(), ctext_size);
+               ctext = talloc_size(tmp_ctx, ctext_size);
                if (ctext == NULL) {
                        TALLOC_FREE(ptext);
                        status = NT_STATUS_NO_MEMORY;