Fixed crash bug which was assuming that fd_ptr was always non-null

(which is not the case with open directories).
Jeremy.
(This used to be commit c154b1601f5891d664fc538ec8874fa8ef2061e6)

3 files changed, 12 insertions, 6 deletions

diff --git a/source3/smbd/files.c b/source3/smbd/files.c
index e58c3834a0..3a41c83766 100644
--- a/source3/smbd/files.c
+++ b/source3/smbd/files.c
@@ -263,6 +263,7 @@ files_struct *file_find_dit(SMB_DEV_T dev, SMB_INO_T inode, struct timeval *tval
 
 	for (fsp=Files;fsp;fsp=fsp->next,count++) {
 		if (fsp->open && 
+			fsp->fd_ptr != NULL &&
 		    fsp->fd_ptr->dev == dev && 
 		    fsp->fd_ptr->inode == inode &&
 		    (tval ? (fsp->open_time.tv_sec == tval->tv_sec) : True ) &&
@@ -287,6 +288,7 @@ files_struct *file_find_di_first(SMB_DEV_T dev, SMB_INO_T inode)
 
     for (fsp=Files;fsp;fsp=fsp->next) {
         if (fsp->open &&
+			fsp->fd_ptr != NULL &&
             fsp->fd_ptr->dev == dev &&
             fsp->fd_ptr->inode == inode )
             return fsp;
@@ -305,6 +307,7 @@ files_struct *file_find_di_next(files_struct *start_fsp)
 
     for (fsp = start_fsp->next;fsp;fsp=fsp->next) {
         if (fsp->open &&
+			fsp->fd_ptr != NULL &&
             fsp->fd_ptr->dev == start_fsp->fd_ptr->dev &&
             fsp->fd_ptr->inode == start_fsp->fd_ptr->inode )
             return fsp;
@@ -337,7 +340,7 @@ void file_sync_all(connection_struct *conn)
 
 	for (fsp=Files;fsp;fsp=next) {
 		next=fsp->next;
-		if (fsp->open && conn == fsp->conn) {
+		if (fsp->open && (conn == fsp->conn) && (fsp->fd_ptr != NULL)) {
 			sync_file(conn,fsp);
 		}
 	}
@@ -371,7 +374,7 @@ void file_free(files_struct *fsp)
 
 	string_free(&fsp->fsp_name);
 
-	if (fsp->fd_ptr && fsp->fd_ptr->ref_count == 0) {
+	if ((fsp->fd_ptr != NULL) && fsp->fd_ptr->ref_count == 0) {
 		fd_ptr_free(fsp->fd_ptr);
 	}
 
diff --git a/source3/smbd/oplock.c b/source3/smbd/oplock.c
index 1d38b362ec..96afb127aa 100644
--- a/source3/smbd/oplock.c
+++ b/source3/smbd/oplock.c
@@ -1008,7 +1008,7 @@ BOOL attempt_close_oplocked_file(files_struct *fsp)
 
   DEBUG(5,("attempt_close_oplocked_file: checking file %s.\n", fsp->fsp_name));
 
-  if (fsp->open && fsp->granted_oplock && !fsp->sent_oplock_break) {
+  if (fsp->open && fsp->granted_oplock && !fsp->sent_oplock_break && (fsp->fd_ptr != NULL)) {
 
     /* Try and break the oplock. */
     file_fd_struct *fd_ptr = fsp->fd_ptr;
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 81ba511c77..db2be094b1 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -1756,7 +1756,7 @@ file %s as a share exists that was not opened with FILE_DELETE access.\n",
                                     (iterate_fsp->share_mode | DELETE_ON_CLOSE_FLAG) :
                                     (iterate_fsp->share_mode & ~DELETE_ON_CLOSE_FLAG) );
 
-              DEBUG(10,("call_trans2setfilepathinfo: Changing share mode for fnum %d, file %s\
+              DEBUG(10,("call_trans2setfilepathinfo: Changing share mode for fnum %d, file %s \
 dev = %x, inode = %.0f from %x to %x\n", 
                     iterate_fsp->fnum, iterate_fsp->fsp_name, (unsigned int)dev, 
                     (double)inode, iterate_fsp->share_mode, new_share_mode ));
@@ -1771,9 +1771,12 @@ dev = %x, inode = %.0f\n", iterate_fsp->fnum, (unsigned int)dev, (double)inode))
              * counted struct. Delete when the last reference
              * goes away.
              */
-            fsp->fd_ptr->delete_on_close = delete_on_close;
+           fsp->fd_ptr->delete_on_close = delete_on_close;
 
-            unlock_share_entry(fsp->conn, dev, inode, token);
+           unlock_share_entry(fsp->conn, dev, inode, token);
+
+           DEBUG(10, ("call_trans2setfilepathinfo: %s delete on close flag for fnum = %d, file %s\n",
+                 delete_on_close ? "Added" : "Removed", fsp->fnum, fsp->fsp_name ));
 
           } /* end if(delete_on_close && !GET_DELETE_ON_CLOSE_FLAG(fsp->share_mode)) */
         } /* end if lp_share_modes() */