lib: Fix a use-after-free in "net vfs getntacl"

Don't hang "sd" off "fsp", which is free'ed before printing

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
Autobuild-User(master): Ralph Böhme <slow@samba.org>
Autobuild-Date(master): Thu Jan 12 16:41:07 UTC 2023 on sn-devel-184

diff --git a/source3/utils/net_vfs.c b/source3/utils/net_vfs.c
index 90822bf368c2983556054f39fd03f15df535fb9a..0cdfc44b9b74ae46d867544863cc527149f017eb 100644 (file)
--- a/source3/utils/net_vfs.c
+++ b/source3/utils/net_vfs.c
@@ -276,7 +276,7 @@ static int net_vfs_get_ntacl(struct net_context *net,
 
        status = SMB_VFS_FGET_NT_ACL(fsp,
                                     SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL,
-                                    fsp,
+                                    talloc_tos(),
                                     &sd);
        if (!NT_STATUS_IS_OK(status)) {
                DBG_ERR("SMB_VFS_FGET_NT_ACL [%s] failed: %s\n",
@@ -296,6 +296,8 @@ static int net_vfs_get_ntacl(struct net_context *net,
 
        rc = 0;
 done:
+       TALLOC_FREE(sd);
+
        if (fsp != NULL) {
                status = close_file_free(NULL, &fsp, NORMAL_CLOSE);
                if (!NT_STATUS_IS_OK(status)) {