misc/118224: smbd 3.0.26a panics

[Denis Eremenko]

>Number:         118224
>Category:       misc
>Synopsis:       smbd 3.0.26a panics
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Nov 23 18:00:05 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator:     Denis Eremenko
>Release:        6-STABLE
>Organization:
>Environment:
>Description:
The panic was introduced by the patch for CVE-2007-4572: https://bugzilla.samba.org/show_bug.cgi?id=5087

Log have something like "PANIC (pid xxxx): push_ascii - dest_len == -1".

>How-To-Repeat:
1. mount -t smbfs //username at hostname/share /mountpoint
2. ls /mountpoint

>Fix:
The patch to 3.0.26a is on https://bugzilla.samba.org/show_bug.cgi?id=5087. It is said to be fixed in 3.0.27a.


>Release-Note:
>Audit-Trail:
>Unformatted: