r21953: One format fix, clarify a condition that the IBM

checker was worried about.
Jeremy.

diff --git a/source/lib/sysacls.c b/source/lib/sysacls.c
index d31c1870c34b2c2d5edd1a0addee0b71c3dbec1a..dcd76407144ef1d7a3fbb5486c4461f9f3e8a7b3 100644 (file)
--- a/source/lib/sysacls.c
+++ b/source/lib/sysacls.c
@@ -181,7 +181,7 @@ char *sys_acl_to_text(SMB_ACL_T acl_d, ssize_t *len_p)
                                        id = idbuf;
                                } else {
                                        id = gr->gr_name;
-       }
+                               }
                        case SMB_ACL_GROUP_OBJ:
                                tag = "group";
                                break;

diff --git a/source/smbd/service.c b/source/smbd/service.c
index c96bcea4e23172d1856f05472661f72f941cf6af..79c618e7b37f81e1035ca587dddc446658cc9000 100644 (file)
--- a/source/smbd/service.c
+++ b/source/smbd/service.c
@@ -915,10 +915,28 @@ static connection_struct *make_connection_snum(int snum, user_struct *vuser,
         */
 
        {
+               BOOL can_write = False;
                NT_USER_TOKEN *token = conn->nt_user_token ?
-                       conn->nt_user_token : vuser->nt_user_token;
+                       conn->nt_user_token :
+                       (vuser ? vuser->nt_user_token : NULL);
+
+               /*
+                * I don't believe this can happen. But the
+                * logic above is convoluted enough to confuse
+                * automated checkers, so be sure. JRA.
+                */
+
+               if (token == NULL) {
+                       DEBUG(0,("make_connection: connection to %s "
+                                "denied due to missing "
+                                "NT token.\n",
+                                 lp_servicename(snum)));
+                       conn_free(conn);
+                       *status = NT_STATUS_ACCESS_DENIED;
+                       return NULL;
+               }
 
-               BOOL can_write = share_access_check(token,
+               can_write = share_access_check(token,
                                                    lp_servicename(snum),
                                                    FILE_WRITE_DATA);