diff options
| author | David Disseldorp <ddiss@samba.org> | 2013-01-15 17:23:08 +0100 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2013-01-16 23:15:07 +0100 |
| commit | c3cc51e8a2f31565c3bac219ea3a78ab4287bcd5 (patch) | |
| tree | f8701bfe5195f9794cf395aa8b858322b962275b | |
| parent | bfe765367e1425fc3ae98e6b8183e6ac5476e97b (diff) | |
| download | samba-c3cc51e8a2f31565c3bac219ea3a78ab4287bcd5.tar.gz samba-c3cc51e8a2f31565c3bac219ea3a78ab4287bcd5.tar.bz2 samba-c3cc51e8a2f31565c3bac219ea3a78ab4287bcd5.zip | |
smb2_ioctl: only pass through to VFS on a valid fsp
A null fsp is dereferenced on VFS call.
Reviewed by: Jeremy Allison <jra@samba.org>
| -rw-r--r-- | source3/smbd/smb2_ioctl_network_fs.c | 30 |
1 files changed, 17 insertions, 13 deletions
diff --git a/source3/smbd/smb2_ioctl_network_fs.c b/source3/smbd/smb2_ioctl_network_fs.c index e984fea4e7..5721a4cc63 100644 --- a/source3/smbd/smb2_ioctl_network_fs.c +++ b/source3/smbd/smb2_ioctl_network_fs.c @@ -505,19 +505,23 @@ struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code, uint8_t *out_data = NULL; uint32_t out_data_len = 0; - status = SMB_VFS_FSCTL(state->fsp, - state, - ctl_code, - state->smbreq->flags2, - state->in_input.data, - state->in_input.length, - &out_data, - state->in_max_output, - &out_data_len); - state->out_output = data_blob_const(out_data, out_data_len); - if (NT_STATUS_IS_OK(status)) { - tevent_req_done(req); - return tevent_req_post(req, ev); + if (state->fsp == NULL) { + status = NT_STATUS_NOT_SUPPORTED; + } else { + status = SMB_VFS_FSCTL(state->fsp, + state, + ctl_code, + state->smbreq->flags2, + state->in_input.data, + state->in_input.length, + &out_data, + state->in_max_output, + &out_data_len); + state->out_output = data_blob_const(out_data, out_data_len); + if (NT_STATUS_IS_OK(status)) { + tevent_req_done(req); + return tevent_req_post(req, ev); + } } if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) { |