s3:nmbd_packets: make sure create_listen_fdset() returns initialized data (bug #8276)

Fix bug #7949 (DoS in Winbind and smbd with many file descriptors open)
(commit feb3fcd0fa4bda0967b881315595d7702f4d1752) changed the bahavior,
so that we skipped some sockets.

This should work for v3-5-test.

metze
(cherry picked from commit 9d5738f779b803fb257537d6308a5f34625cb1b0)

diff --git a/source3/nmbd/nmbd_packets.c b/source3/nmbd/nmbd_packets.c
index 0eafb2cabead03361b15c0eca1605aa74ffafbfb..e53eebb0067cf003ef4d8e9b412a2399764c7f7d 100644 (file)
--- a/source3/nmbd/nmbd_packets.c
+++ b/source3/nmbd/nmbd_packets.c
@@ -1729,19 +1729,23 @@ only use %d.\n", count, FD_SETSIZE));
        for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) {
                if (subrec->nmb_sock < 0 || subrec->nmb_sock >= FD_SETSIZE) {
                        /* We have to ignore sockets outside FD_SETSIZE. */
-                       continue;
+                       sock_array[num++] = -1;
+               } else {
+                       FD_SET(subrec->nmb_sock,pset);
+                       sock_array[num++] = subrec->nmb_sock;
+                       *maxfd = MAX( *maxfd, subrec->nmb_sock);
                }
-               FD_SET(subrec->nmb_sock,pset);
-               sock_array[num++] = subrec->nmb_sock;
-               *maxfd = MAX( *maxfd, subrec->nmb_sock);
 
                if (subrec->nmb_bcast < 0 || subrec->nmb_bcast >= FD_SETSIZE) {
                        /* We have to ignore sockets outside FD_SETSIZE. */
-                       continue;
+                       sock_array[num++] = -1;
+               } else {
+                       sock_array[num++] = subrec->nmb_bcast;
+                       if (subrec->nmb_bcast != -1) {
+                               FD_SET(subrec->nmb_bcast,pset);
+                               *maxfd = MAX( *maxfd, subrec->nmb_bcast);
+                       }
                }
-               sock_array[num++] = subrec->nmb_bcast;
-               FD_SET(subrec->nmb_bcast,pset);
-               *maxfd = MAX( *maxfd, subrec->nmb_bcast);
        }
 
        /* Add in the lp_socket_address() interface on 138. */
@@ -1761,23 +1765,27 @@ only use %d.\n", count, FD_SETSIZE));
        for (subrec = FIRST_SUBNET; subrec; subrec = NEXT_SUBNET_EXCLUDING_UNICAST(subrec)) {
                if (subrec->dgram_sock < 0 || subrec->dgram_sock >= FD_SETSIZE) {
                        /* We have to ignore sockets outside FD_SETSIZE. */
-                       continue;
+                       sock_array[num++] = -1;
+               } else {
+                       FD_SET(subrec->dgram_sock,pset);
+                       sock_array[num++] = subrec->dgram_sock;
+                       *maxfd = MAX( *maxfd, subrec->dgram_sock);
                }
-               FD_SET(subrec->dgram_sock,pset);
-               sock_array[num++] = subrec->dgram_sock;
-               *maxfd = MAX( *maxfd, subrec->dgram_sock);
 
                if (subrec->dgram_bcast < 0 || subrec->dgram_bcast >= FD_SETSIZE) {
                        /* We have to ignore sockets outside FD_SETSIZE. */
-                       continue;
-               }
-               sock_array[num++] = subrec->dgram_bcast;
-               if (subrec->dgram_bcast != -1) {
-                       FD_SET(subrec->dgram_bcast,pset);
-                       *maxfd = MAX( *maxfd, subrec->dgram_bcast);
+                       sock_array[num++] = -1;
+               } else {
+                       sock_array[num++] = subrec->dgram_bcast;
+                       if (subrec->dgram_bcast != -1) {
+                               FD_SET(subrec->dgram_bcast,pset);
+                               *maxfd = MAX( *maxfd, subrec->dgram_bcast);
+                       }
                }
        }
 
+       SMB_ASSERT(count == num);
+
        *listen_number = count;
 
        SAFE_FREE(*ppset);