From: Jeremy Allison <jra@samba.org>
Date: Mon, 19 Dec 2016 20:32:07 +0000 (-0800)
Subject: CVE-2017-2619: s3: smbd: Move the reference counting and destructor setup to just... 
X-Git-Tag: samba-4.4.12~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=af839aeb5a809d8eb1ec56d0f27e4716e2cbd24b;p=thirdparty%2Fsamba.git

CVE-2017-2619: s3: smbd: Move the reference counting and destructor setup to just before retuning success.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
---

diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c
index b8034be1557..6b62f1415cf 100644
--- a/source3/smbd/dir.c
+++ b/source3/smbd/dir.c
@@ -1728,11 +1728,6 @@ static struct smb_Dir *OpenDir_fsp(TALLOC_CTX *mem_ctx, connection_struct *conn,
 		goto fail;
 	}
 
-	if (sconn && !sconn->using_smb2) {
-		sconn->searches.dirhandles_open++;
-	}
-	talloc_set_destructor(dirp, smb_Dir_destructor);
-
 	dirp->dir = SMB_VFS_FDOPENDIR(fsp, mask, attr);
 	if (dirp->dir != NULL) {
 		dirp->fsp = fsp;
@@ -1757,6 +1752,11 @@ static struct smb_Dir *OpenDir_fsp(TALLOC_CTX *mem_ctx, connection_struct *conn,
 		goto fail;
 	}
 
+	if (sconn && !sconn->using_smb2) {
+		sconn->searches.dirhandles_open++;
+	}
+	talloc_set_destructor(dirp, smb_Dir_destructor);
+
 	return dirp;
 
   fail: