Subject: [PATCH 28/35] s3: smbd: OpenDir_fsp() use early returns.

From: Jeremy Allison <[email-masked]>
Date: Mon, 19 Dec 2016 12:13:20 -0800

CVE-2017-2619

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <[email-masked]>
---
 source3/smbd/dir.c | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c
index e14bf9b9b14..2f63342e39a 100644
--- a/source3/smbd/dir.c
+++ b/source3/smbd/dir.c
@@ -1700,15 +1700,16 @@ static struct smb_Dir *OpenDir_fsp(TALLOC_CTX *mem_ctx, connection_struct *conn,
 	struct smbd_server_connection *sconn = conn->sconn;
 
 	if (!dirp) {
-		return NULL;
+		goto fail;
 	}
 
-	dirp->dir = SMB_VFS_OPENDIR(conn, smb_dname, mask, attr);
+	if (!fsp->is_directory) {
+		errno = EBADF;
+		goto fail;
+	}
 
-	if (!dirp->dir) {
-		DEBUG(5,("OpenDir: Can't open %s. %s\n",
-			smb_dname->base_name,
-			strerror(errno) ));
+	if (fsp->fh->fd == -1) {
+		errno = EBADF;
 		goto fail;
 	}
 
@@ -1726,18 +1727,16 @@ static struct smb_Dir *OpenDir_fsp(TALLOC_CTX *mem_ctx, connection_struct *conn,
 	}
 	talloc_set_destructor(dirp, smb_Dir_destructor);
 
-	if (fsp->is_directory && fsp->fh->fd != -1) {
-		dirp->dir = SMB_VFS_FDOPENDIR(fsp, mask, attr);
-		if (dirp->dir != NULL) {
-			dirp->fsp = fsp;
-		} else {
-			DEBUG(10,("OpenDir_fsp: SMB_VFS_FDOPENDIR on %s returned "
-				"NULL (%s)\n",
-				dirp->dir_path,
-				strerror(errno)));
-			if (errno != ENOSYS) {
-				return NULL;
-			}
+	dirp->dir = SMB_VFS_FDOPENDIR(fsp, mask, attr);
+	if (dirp->dir != NULL) {
+		dirp->fsp = fsp;
+	} else {
+		DEBUG(10,("OpenDir_fsp: SMB_VFS_FDOPENDIR on %s returned "
+			"NULL (%s)\n",
+			dirp->dir_path,
+			strerror(errno)));
+		if (errno != ENOSYS) {
+			return NULL;
 		}
 	}
 
-- 
2.12.0.rc1.440.g5b76565f74-goog