Bug 36162

Summary: smbd constantly crashes when filename contains non-ascii character
Product: UCS Reporter: Tim Petersen <petersen>
Component: Samba4Assignee: Arvid Requate <requate>
Status: CLOSED FIXED QA Contact: Felix Botner <botner>
Severity: normal    
Priority: P5 CC: gohmann, requate, walkenhorst
Version: UCS 3.2   
Target Milestone: UCS 3.2-3-errata   
Hardware: Other   
OS: Linux   
What kind of report is it?: --- What type of bug is this?: ---
Who will be affected by this bug?: --- How will those affected feel about the bug?: ---
User Pain: Enterprise Customer affected?:
School Customer affected?: ISV affected?:
Waiting Support: Flags outvoted (downgraded) after PO Review:
Ticket number: Bug group (optional):
Max CVSS v3 score:
Bug Depends on:    
Bug Blocks: 36216    
Attachments: sambabug_10716.patch
98_sambabug_10716.patch

Description Tim Petersen univentionstaff 2014-10-13 12:53:07 CEST
Rrported at #2014101321000221

Please see Samba Bug:
https://bugzilla.samba.org/show_bug.cgi?id=10716
Comment 1 Arvid Requate univentionstaff 2014-10-13 13:58:16 CEST
Created attachment 6159 [details]
sambabug_10716.patch

Upstream patch, applies cleanly when split into two parts.
Comment 2 Arvid Requate univentionstaff 2014-10-13 14:14:14 CEST
Created attachment 6160 [details]
98_sambabug_10716.patch

This is the patch as merged into upstream git.
Comment 3 Arvid Requate univentionstaff 2014-10-13 14:33:51 CEST
Advisory: 2014-10-13-samba.yaml
Comment 4 Felix Botner univentionstaff 2014-10-15 12:36:49 CEST
can be reproduced with:

-> cd /home/Administrator/
-> more a.c 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv)
{
        char bad_file[] = {'f', 'i', 'l', 'e', '-', 0xE9, 0};
        FILE *f;

        printf("Create %s\n", bad_file);

        f = fopen(bad_file, "a");
        if (f == NULL)
                perror("fopen");
        else
                fclose(f);

        return 0;
}
-> make a
-> ./a
Create file-�

-> mount.cifs  //10.200.7.50/Administrator \
   -o user=Administrator,pass=univention /mnt/
-> cd /mnt
-> ./a

=>   PANIC (pid 31118): ndr_push_share_mode_lock failed



OK - works with errata3.2-3 and UCS 4.0
OK - YAML
Comment 5 Janek Walkenhorst univentionstaff 2014-10-16 13:42:48 CEST
http://errata.univention.de/ucs/3.2/221.html
Comment 6 Janek Walkenhorst univentionstaff 2014-10-22 16:07:31 CEST
http://errata.univention.de/ucs/3.2/224.html