From: Volker Lendecke <vl@samba.org>
Date: Tue, 9 Mar 2010 10:14:14 +0000 (+0100)
Subject: s3: Fix a NULL pointer dereference
X-Git-Tag: samba-3.6.0pre1~4627
X-Git-Url: http://git.samba.org/?p=samba.git;a=commitdiff_plain;h=25452a2268ac7013

s3: Fix a NULL pointer dereference

Found by Laurent Gaffie <laurent.gaffie@gmail.com>.

Thanks!

Volker
---

diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 65bb25db596..9a39779a2bc 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -1810,6 +1810,15 @@ void chain_reply(struct smb_request *req)
 	 */
 
 	if ((req->wct < 2) || (CVAL(req->outbuf, smb_wct) < 2)) {
+		if (req->chain_outbuf == NULL) {
+			req->chain_outbuf = TALLOC_REALLOC_ARRAY(
+				req, req->outbuf, uint8_t,
+				smb_len(req->outbuf) + 4);
+			if (req->chain_outbuf == NULL) {
+				smb_panic("talloc failed");
+			}
+		}
+		req->outbuf = NULL;
 		goto error;
 	}
 
@@ -1837,7 +1846,7 @@ void chain_reply(struct smb_request *req)
 		req->chain_outbuf = TALLOC_REALLOC_ARRAY(
 			req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
 		if (req->chain_outbuf == NULL) {
-			goto error;
+			smb_panic("talloc failed");
 		}
 		req->outbuf = NULL;
 	} else {