diff options
| author | Ralph Boehme <slow@samba.org> | 2017-03-19 15:58:17 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2017-03-22 10:45:15 +0100 |
| commit | d295ad1aaf728f993eaedf52f43f4fa1ab563c9b (patch) | |
| tree | c2f4dd5fc142d2fe455a35028ae83f15bc07f884 | |
| parent | 2a6683c34a10631f0f9036c9281705f8951d0144 (diff) | |
| download | samba-d295ad1aaf728f993eaedf52f43f4fa1ab563c9b.tar.gz | |
CVE-2017-2619: s3/smbd: re-open directory after dptr_CloseDir()
dptr_CloseDir() will close and invalidate the fsp's file descriptor, we
have to reopen it.
Bug: https://bugzilla.samba.org/show_bug.cgi?id=12496
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
| -rw-r--r-- | source3/smbd/smb2_query_directory.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/source3/smbd/smb2_query_directory.c b/source3/smbd/smb2_query_directory.c index 4b6ca1b8c0a..170331003af 100644 --- a/source3/smbd/smb2_query_directory.c +++ b/source3/smbd/smb2_query_directory.c @@ -24,6 +24,7 @@ #include "../libcli/smb/smb_common.h" #include "trans2.h" #include "../lib/util/tevent_ntstatus.h" +#include "system/filesys.h" static struct tevent_req *smbd_smb2_query_directory_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev, @@ -322,7 +323,23 @@ static struct tevent_req *smbd_smb2_query_directory_send(TALLOC_CTX *mem_ctx, } if (in_flags & SMB2_CONTINUE_FLAG_REOPEN) { + int flags; + dptr_CloseDir(fsp); + + /* + * dptr_CloseDir() will close and invalidate the fsp's file + * descriptor, we have to reopen it. + */ + + flags = O_RDONLY; +#ifdef O_DIRECTORY + flags |= O_DIRECTORY; +#endif + status = fd_open(conn, fsp, flags, 0); + if (tevent_req_nterror(req, status)) { + return tevent_req_post(req, ev); + } } if (!smbreq->posix_pathnames) { |