Torture test for bug #6315 - smbd crashes doing vfs_full_audit on IPC$ close event.

Shows that doing a tdis with invalid uid succeeds.
Jeremy.

1 files changed, 28 insertions, 2 deletions

diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index c9199eb36f..804cdf36bc 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -5143,6 +5143,7 @@ static bool run_uid_regression_test(int dummy)
 {
 	static struct cli_state *cli;
 	int16_t old_vuid;
+	int16_t old_cnum;
 	bool correct = True;
 
 	printf("starting uid regression test\n");
@@ -5172,14 +5173,39 @@ static bool run_uid_regression_test(int dummy)
 				NT_STATUS_NO_SUCH_USER)) {
 			return False;
 		}
-		goto out;
+	}
+
+	old_cnum = cli->cnum;
+
+	/* Now try a SMBtdis with the invald vuid set to zero. */
+	cli->vuid = 0;
+
+	/* This should succeed. */
+	if (cli_tdis(cli)) {
+		printf("First tdis with invalid vuid should succeed.\n");
+	} else {
+		printf("First tdis failed (%s)\n", cli_errstr(cli));
+	}
+
+	cli->vuid = old_vuid;
+	cli->cnum = old_cnum;
+
+	/* This should fail. */
+	if (cli_tdis(cli)) {
+		printf("Second tdis with invalid vuid should fail - succeeded instead !.\n");
+	} else {
+		/* Should be bad tid. */
+		if (!check_error(__LINE__, cli, ERRSRV, ERRinvnid,
+				NT_STATUS_NETWORK_NAME_DELETED)) {
+			return False;
+		}
 	}
 
 	cli_rmdir(cli, "\\uid_reg_test");
 
   out:
 
-	torture_close_connection(cli);
+	cli_shutdown(cli);
 	return correct;
 }