From: Jeremy Allison <jra@samba.org>
Date: Tue, 20 Dec 2016 00:25:26 +0000 (-0800)
Subject: CVE-2017-2619: s3: smbd: Opendir_internal() early return if SMB_VFS_OPENDIR failed.
X-Git-Tag: tdb-1.3.13~399
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=682d597ee3b23e9f49e124e1e04e2b288c9a053f;p=thirdparty%2Fsamba.git

CVE-2017-2619: s3: smbd: Opendir_internal() early return if SMB_VFS_OPENDIR failed.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Uri Simchoni <uri@samba.org>
---

diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c
index b22d92d7ba9..a5d172a86e1 100644
--- a/source3/smbd/dir.c
+++ b/source3/smbd/dir.c
@@ -1643,6 +1643,15 @@ static struct smb_Dir *OpenDir_internal(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
+	dirp->dir = SMB_VFS_OPENDIR(conn, smb_dname, mask, attr);
+
+	if (!dirp->dir) {
+		DEBUG(5,("OpenDir: Can't open %s. %s\n",
+			smb_dname->base_name,
+			strerror(errno) ));
+		goto fail;
+	}
+
 	dirp->conn = conn;
 	dirp->name_cache_size = lp_directory_name_cache_size(SNUM(conn));
 
@@ -1657,15 +1666,6 @@ static struct smb_Dir *OpenDir_internal(TALLOC_CTX *mem_ctx,
 	}
 	talloc_set_destructor(dirp, smb_Dir_destructor);
 
-	dirp->dir = SMB_VFS_OPENDIR(conn, dirp->dir_smb_fname, mask, attr);
-
-	if (!dirp->dir) {
-		DEBUG(5,("OpenDir: Can't open %s. %s\n",
-			dirp->dir_smb_fname->base_name,
-			strerror(errno) ));
-		goto fail;
-	}
-
 	return dirp;
 
   fail: