lib/talloc: Disrupt buffer overflow attacks on Samba by using random magic
authorAndrew Bartlett <abartlet@samba.org>
Wed, 16 Oct 2013 21:30:23 +0000 (10:30 +1300)
committerJeremy Allison <jra@samba.org>
Fri, 9 Oct 2015 18:14:06 +0000 (20:14 +0200)
commit30ea897194c68c149d4986b22a5d964454bec258
treec782c13b8d26a5dcb5ed098f1b0f4b0d09f22d60
parent1dc05386f20481596ee7360d6f4e628a16675d3f
lib/talloc: Disrupt buffer overflow attacks on Samba by using random magic

By setting the talloc magic to a random value, we make it much harder to overwrite a talloc_chunk
in a valid way with a simple buffer overflow.

The flags are placed before more senstive variables so they have to be overwritten first.

Inspired by the exploit in: http://blog.csnc.ch/wp-content/uploads/2012/07/sambaexploit_v1.0.pdf

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Adrian Cochrane <adrianc@catalyst.net.nz>
Reviewed-by: Jeremy Allison <jra@samba.org>
lib/talloc/talloc.c
lib/talloc/wscript