Subject: [PATCH 26/35] s3: smbd: Opendir_internal() early return if SMB_VFS_OPENDIR failed.

From: Jeremy Allison <[email-masked]>
Date: Mon, 19 Dec 2016 16:25:26 -0800

CVE-2017-2619

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12496

Signed-off-by: Jeremy Allison <[email-masked]>
---
 source3/smbd/dir.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/source3/smbd/dir.c b/source3/smbd/dir.c
index fe8f4f5f2f0..d3d4dc6721b 100644
--- a/source3/smbd/dir.c
+++ b/source3/smbd/dir.c
@@ -1595,20 +1595,12 @@ static struct smb_Dir *OpenDir_internal(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
-	dirp->conn = conn;
-	dirp->name_cache_size = lp_directory_name_cache_size(SNUM(conn));
-
 	dirp->dir_path = talloc_strdup(dirp, name);
 	if (!dirp->dir_path) {
 		errno = ENOMEM;
 		goto fail;
 	}
 
-	if (sconn && !sconn->using_smb2) {
-		sconn->searches.dirhandles_open++;
-	}
-	talloc_set_destructor(dirp, smb_Dir_destructor);
-
 	dirp->dir = SMB_VFS_OPENDIR(conn, dirp->dir_path, mask, attr);
 	if (!dirp->dir) {
 		DEBUG(5,("OpenDir: Can't open %s. %s\n", dirp->dir_path,
@@ -1616,6 +1608,14 @@ static struct smb_Dir *OpenDir_internal(TALLOC_CTX *mem_ctx,
 		goto fail;
 	}
 
+	dirp->conn = conn;
+	dirp->name_cache_size = lp_directory_name_cache_size(SNUM(conn));
+
+	if (sconn && !sconn->using_smb2) {
+		sconn->searches.dirhandles_open++;
+	}
+	talloc_set_destructor(dirp, smb_Dir_destructor);
+
 	return dirp;
 
   fail:
@@ -1651,6 +1651,15 @@ static struct smb_Dir *OpenDir_fsp(TALLOC_CTX *mem_ctx, connection_struct *conn,
 		return NULL;
 	}
 
+	dirp->dir = SMB_VFS_OPENDIR(conn, smb_dname, mask, attr);
+
+	if (!dirp->dir) {
+		DEBUG(5,("OpenDir: Can't open %s. %s\n",
+			smb_dname->base_name,
+			strerror(errno) ));
+		goto fail;
+	}
+
 	dirp->conn = conn;
 	dirp->name_cache_size = lp_directory_name_cache_size(SNUM(conn));
 
-- 
2.12.0.rc1.440.g5b76565f74-goog