summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Disseldorp <ddiss@samba.org>2013-01-15 17:23:08 +0100
committerJeremy Allison <jra@samba.org>2013-01-16 23:15:07 +0100
commitc3cc51e8a2f31565c3bac219ea3a78ab4287bcd5 (patch)
treef8701bfe5195f9794cf395aa8b858322b962275b
parentbfe765367e1425fc3ae98e6b8183e6ac5476e97b (diff)
downloadsamba-c3cc51e8a2f31565c3bac219ea3a78ab4287bcd5.tar.gz
samba-c3cc51e8a2f31565c3bac219ea3a78ab4287bcd5.tar.bz2
samba-c3cc51e8a2f31565c3bac219ea3a78ab4287bcd5.zip
smb2_ioctl: only pass through to VFS on a valid fsp
A null fsp is dereferenced on VFS call. Reviewed by: Jeremy Allison <jra@samba.org>
-rw-r--r--source3/smbd/smb2_ioctl_network_fs.c30
1 files changed, 17 insertions, 13 deletions
diff --git a/source3/smbd/smb2_ioctl_network_fs.c b/source3/smbd/smb2_ioctl_network_fs.c
index e984fea4e7..5721a4cc63 100644
--- a/source3/smbd/smb2_ioctl_network_fs.c
+++ b/source3/smbd/smb2_ioctl_network_fs.c
@@ -505,19 +505,23 @@ struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
uint8_t *out_data = NULL;
uint32_t out_data_len = 0;
- status = SMB_VFS_FSCTL(state->fsp,
- state,
- ctl_code,
- state->smbreq->flags2,
- state->in_input.data,
- state->in_input.length,
- &out_data,
- state->in_max_output,
- &out_data_len);
- state->out_output = data_blob_const(out_data, out_data_len);
- if (NT_STATUS_IS_OK(status)) {
- tevent_req_done(req);
- return tevent_req_post(req, ev);
+ if (state->fsp == NULL) {
+ status = NT_STATUS_NOT_SUPPORTED;
+ } else {
+ status = SMB_VFS_FSCTL(state->fsp,
+ state,
+ ctl_code,
+ state->smbreq->flags2,
+ state->in_input.data,
+ state->in_input.length,
+ &out_data,
+ state->in_max_output,
+ &out_data_len);
+ state->out_output = data_blob_const(out_data, out_data_len);
+ if (NT_STATUS_IS_OK(status)) {
+ tevent_req_done(req);
+ return tevent_req_post(req, ev);
+ }
}
if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {