Fixed sys_lseek and seek_file calls so all returns

are *checked* :-).
Jeremy.

diff --git a/source/lib/util.c b/source/lib/util.c
index d0cb51f3caa34e331ddbb5286cc3c75e43254430..8660e22e5776843e7ca1a03ba70989fae1b88d55 100644 (file)
--- a/source/lib/util.c
+++ b/source/lib/util.c
@@ -3082,7 +3082,7 @@ int set_filelen(int fd, SMB_OFF_T len)
   char c = 0;
   SMB_OFF_T currpos = sys_lseek(fd, (SMB_OFF_T)0, SEEK_CUR);
 
-  if(currpos < 0)
+  if(currpos == -1)
     return -1;
   /* Do an fstat to see if the file is longer than
      the requested size (call ftruncate),
@@ -3105,7 +3105,8 @@ int set_filelen(int fd, SMB_OFF_T len)
   if(write(fd, &c, 1)!=1)
     return -1;
   /* Seek to where we were */
-  sys_lseek(fd, currpos, SEEK_SET);
+  if(sys_lseek(fd, currpos, SEEK_SET) != currpos)
+    return -1;
   return 0;
 #endif
 }

diff --git a/source/locking/shmem.c b/source/locking/shmem.c
index b63db1f168dc7fa0b422a2f57de4b1233bc5cec7..2a4e4de129a2c7ecaf19b13ce5a8b4c0f9d76edb 100644 (file)
--- a/source/locking/shmem.c
+++ b/source/locking/shmem.c
@@ -311,71 +311,113 @@ static BOOL smb_shm_create_hash_table( unsigned int size )
 
 static BOOL smb_shm_register_process(char *processreg_file, pid_t pid, BOOL *other_processes)
 {
-   int smb_shm_processes_fd = -1;
-   int nb_read;
-   pid_t other_pid;
-   SMB_OFF_T seek_back = -((SMB_OFF_T)sizeof(other_pid));
-   SMB_OFF_T free_slot = -1;
-   SMB_OFF_T erased_slot;   
-   
-   smb_shm_processes_fd = open(processreg_file, 
-                              read_only?O_RDONLY:(O_RDWR|O_CREAT), 
-                              SHM_FILE_MODE);
-
-   if ( smb_shm_processes_fd < 0 )
-   {
-      DEBUG(0,("ERROR smb_shm_register_process : processreg_file open failed with code %s\n",strerror(errno)));
-      return False;
-   }
-   
-   *other_processes = False;
-   
-   while ((nb_read = read(smb_shm_processes_fd, &other_pid, sizeof(other_pid))) > 0)
-   {
-      if(other_pid)
+  int smb_shm_processes_fd = -1;
+  int nb_read;
+  pid_t other_pid;
+  SMB_OFF_T seek_back = -((SMB_OFF_T)sizeof(other_pid));
+  SMB_OFF_T free_slot = -1;
+  SMB_OFF_T erased_slot;   
+   
+  smb_shm_processes_fd = open(processreg_file, 
+                              read_only?O_RDONLY:(O_RDWR|O_CREAT), 
+                              SHM_FILE_MODE);
+
+  if ( smb_shm_processes_fd < 0 )
+  {
+     DEBUG(0, ("ERROR smb_shm_register_process : processreg_file \
+open failed with code %s\n",strerror(errno)));
+     return False;
+  }
+   
+  *other_processes = False;
+   
+  while ((nb_read = read(smb_shm_processes_fd, &other_pid, sizeof(other_pid))) > 0)
+  {
+    if(other_pid)
+    {
+      if(process_exists(other_pid))
+        *other_processes = True;
+      else
       {
-        if(process_exists(other_pid))
-           *other_processes = True;
-        else
-        {
-           /* erase old pid */
-            DEBUG(5,("smb_shm_register_process : erasing stale record for pid %d (seek_back = %.0f)\n",
-                      (int)other_pid, (double)seek_back));
-           other_pid = (pid_t)0;
-           erased_slot = sys_lseek(smb_shm_processes_fd, seek_back, SEEK_CUR);
-           write(smb_shm_processes_fd, &other_pid, sizeof(other_pid));
-           if(free_slot < 0)
-              free_slot = erased_slot;
-        }
+        /* erase old pid */
+        DEBUG(5,("smb_shm_register_process : erasing stale record \
+for pid %d (seek_back = %.0f)\n", (int)other_pid, (double)seek_back));
+        other_pid = (pid_t)0;
+        if((erased_slot = sys_lseek(smb_shm_processes_fd,
+                                    seek_back, SEEK_CUR)) == -1)
+        {
+          DEBUG(0, ("ERROR smb_shm_register_process : sys_lseek failed \
+with error %s\n", strerror(errno)));
+          close(smb_shm_processes_fd);
+          return False;
+        }
+        
+        if(write(smb_shm_processes_fd, &other_pid, sizeof(other_pid)) == -1)
+        {
+           DEBUG(0, ("ERROR smb_shm_register_process : write failed \
+with error %s\n", strerror(errno)));
+           close(smb_shm_processes_fd);
+           return False;
+        }
+
+        if(free_slot < 0)
+          free_slot = erased_slot;
       }
-      else 
-        if(free_slot < 0)
-           free_slot = sys_lseek(smb_shm_processes_fd, seek_back, SEEK_CUR);
-   }
-   if (nb_read < 0)
-   {
-      DEBUG(0,("ERROR smb_shm_register_process : processreg_file read failed with code %s\n",strerror(errno)));
+    }
+    else 
+    {
+      if(free_slot < 0)
+      {
+        if((free_slot = sys_lseek(smb_shm_processes_fd, 
+                                  seek_back, SEEK_CUR))==-1)
+        {
+          DEBUG(0, ("ERROR smb_shm_register_process : sys_lseek \
+failed with error %s\n", strerror(errno)));
+          close(smb_shm_processes_fd);
+          return False; 
+        }
+      } /* end if free_slot */
+    } /* end else */
+  } /* end if other_pid */
+
+  if (nb_read < 0)
+  {
+    DEBUG(0,("ERROR smb_shm_register_process : processreg_file read \
+failed with code %s\n",strerror(errno)));
+    close(smb_shm_processes_fd);
+    return False;
+  }
+   
+  if(free_slot < 0)
+  {
+    if((free_slot = sys_lseek(smb_shm_processes_fd, 0, SEEK_END)) == -1)
+    {
+      DEBUG(0,("ERROR smb_shm_register_process : sys_lseek failed with code %s\n",strerror(errno)));
       close(smb_shm_processes_fd);
       return False;
-   }
-   
-   if(free_slot < 0)
-      free_slot = sys_lseek(smb_shm_processes_fd, 0, SEEK_END);
+    }
+  }
 
-   DEBUG(5,("smb_shm_register_process : writing record for pid %d at offset %.0f\n",
+  DEBUG(5,("smb_shm_register_process : writing record for pid %d at offset %.0f\n",
          (int)pid, (double)free_slot));
 
-   sys_lseek(smb_shm_processes_fd, free_slot, SEEK_SET);
-   if(write(smb_shm_processes_fd, &pid, sizeof(pid)) < 0)
-   {
-      DEBUG(0,("ERROR smb_shm_register_process : processreg_file write failed with code %s\n",strerror(errno)));
-      close(smb_shm_processes_fd);
-      return False;
-   }
+  if(sys_lseek(smb_shm_processes_fd, free_slot, SEEK_SET) == -1)
+  {
+    DEBUG(0,("ERROR smb_shm_register_process : sys_lseek failed with code %s\n",strerror(errno)));
+    close(smb_shm_processes_fd);
+    return False;
+  }
 
-   close(smb_shm_processes_fd);
+  if(write(smb_shm_processes_fd, &pid, sizeof(pid)) == -1)
+  {
+    DEBUG(0,("ERROR smb_shm_register_process : processreg_file write failed with code %s\n",strerror(errno)));
+    close(smb_shm_processes_fd);
+    return False;
+  }
 
-   return True;
+  close(smb_shm_processes_fd);
+
+  return True;
 }
 
 static BOOL smb_shm_unregister_process(char *processreg_file, pid_t pid)
@@ -754,136 +796,164 @@ static struct shmem_ops shmops = {
   ******************************************************************/
 struct shmem_ops *smb_shm_open(int ronly)
 {
-       pstring file_name;
-       SMB_OFF_T filesize;
-       BOOL created_new = False;
-       BOOL other_processes = True;
-       SMB_OFF_T size = (SMB_OFF_T)lp_shmem_size();
-
-       read_only = ronly;
+  pstring file_name;
+  SMB_OFF_T filesize;
+  BOOL created_new = False;
+  BOOL other_processes = True;
+  SMB_OFF_T size = (SMB_OFF_T)lp_shmem_size();
 
-       pstrcpy(file_name,lp_lockdir());
-       if (!directory_exist(file_name,NULL)) {
-               if (read_only) return NULL;
-               mkdir(file_name,0755);
-       }
-       trim_string(file_name,"","/");
-       if (!*file_name) return(False);
-       pstrcat(file_name, "/SHARE_MEM_FILE");
-   
-   DEBUG(5,("smb_shm_open : using shmem file %s to be of size %.0f\n",file_name,(double)size));
-
-   smb_shm_fd = open(file_name, read_only?O_RDONLY:(O_RDWR|O_CREAT),
-                    SHM_FILE_MODE);
+  read_only = ronly;
 
-   if ( smb_shm_fd < 0 )
-   {
-      DEBUG(0,("ERROR smb_shm_open : open failed with code %s\n",strerror(errno)));
+  pstrcpy(file_name,lp_lockdir());
+  if (!directory_exist(file_name,NULL)) {
+    if (read_only)
       return NULL;
-   }
-   
-   if (!smb_shm_global_lock())
-   {
-      DEBUG(0,("ERROR smb_shm_open : can't do smb_shm_global_lock\n"));
-      return NULL;
-   }
-   
-   if( (filesize = sys_lseek(smb_shm_fd, 0, SEEK_END)) < 0)
-   {
-      DEBUG(0,("ERROR smb_shm_open : lseek failed with code %s\n",strerror(errno)));
-      smb_shm_global_unlock();
-      close(smb_shm_fd);
-      return NULL;
-   }
-
-   /* return the file offset to 0 to save on later seeks */
-   sys_lseek(smb_shm_fd,0,SEEK_SET);
-
-   if (filesize == 0)
-   {
-      /* we just created a new one */
-      created_new = True;
-   }
-   
-   /* to find out if some other process is already mapping the file,
-      we use a registration file containing the processids of the file mapping processes
-      */
-
-   /* construct processreg file name */
-   pstrcpy(smb_shm_processreg_name, file_name);
-   pstrcat(smb_shm_processreg_name, ".processes");
-
-   if (!read_only && 
-       !smb_shm_register_process(smb_shm_processreg_name, getpid(), &other_processes))
-   {
+    mkdir(file_name,0755);
+  }
+  trim_string(file_name,"","/");
+  if (!*file_name)
+    return(False);
+  pstrcat(file_name, "/SHARE_MEM_FILE");
+   
+  DEBUG(5,("smb_shm_open : using shmem file %s to be of size %.0f\n",
+        file_name,(double)size));
+
+  smb_shm_fd = open(file_name, read_only?O_RDONLY:(O_RDWR|O_CREAT),
+                    SHM_FILE_MODE);
+
+  if ( smb_shm_fd < 0 )
+  {
+    DEBUG(0,("ERROR smb_shm_open : open failed with code %s\n",strerror(errno)));
+    return NULL;
+  }
+   
+  if (!smb_shm_global_lock())
+  {
+    DEBUG(0,("ERROR smb_shm_open : can't do smb_shm_global_lock\n"));
+    return NULL;
+  }
+   
+  if( (filesize = sys_lseek(smb_shm_fd, 0, SEEK_END)) == -1)
+  {
+    DEBUG(0,("ERROR smb_shm_open : sys_lseek failed with code %s\n",
+          strerror(errno)));
+    smb_shm_global_unlock();
+    close(smb_shm_fd);
+    return NULL;
+  }
+
+  /* 
+   * Return the file offset to 0 to save on later seeks.
+   */
+  if(sys_lseek(smb_shm_fd,0,SEEK_SET) == -1)
+  {
+    DEBUG(0,("ERROR smb_shm_open : sys_lseek failed with code %s\n",
+          strerror(errno)));
+    smb_shm_global_unlock();
+    close(smb_shm_fd);
+    return NULL;
+  }
+
+  if (filesize == 0)
+  {
+    /* 
+     * We just created a new one.
+     */
+    created_new = True;
+  }
+   
+  /* 
+   * To find out if some other process is already mapping the file,
+   * we use a registration file containing the processids of the file
+   * mapping processes.
+   */
+
+  /* construct processreg file name */
+  pstrcpy(smb_shm_processreg_name, file_name);
+  pstrcat(smb_shm_processreg_name, ".processes");
+
+  if (!read_only && !smb_shm_register_process(smb_shm_processreg_name,
+                                              getpid(), &other_processes))
+  {
+    smb_shm_global_unlock();
+    close(smb_shm_fd);
+    return NULL;
+  }
+
+  if (!read_only && (created_new || !other_processes))
+  {
+    /* we just created a new one, or are the first opener, lets set it size */
+    if( sys_ftruncate(smb_shm_fd, size) <0)
+    {
+      DEBUG(0,("ERROR smb_shm_open : ftruncate failed with code %s\n",
+            strerror(errno)));
+      smb_shm_unregister_process(smb_shm_processreg_name, getpid());
       smb_shm_global_unlock();
       close(smb_shm_fd);
       return NULL;
-   }
-
-   if (!read_only && (created_new || !other_processes))
-   {
-      /* we just created a new one, or are the first opener, lets set it size */
-      if( sys_ftruncate(smb_shm_fd, size) <0)
-      {
-        DEBUG(0,("ERROR smb_shm_open : ftruncate failed with code %s\n",strerror(errno)));
-        smb_shm_unregister_process(smb_shm_processreg_name, getpid());
-        smb_shm_global_unlock();
-        close(smb_shm_fd);
-        return NULL;
-      }
-
-      /* paranoia */
-      sys_lseek(smb_shm_fd,0,SEEK_SET);
-
-      filesize = size;
-   }
-   
-   if (size != filesize )
-   {
-      /* the existing file has a different size and we are not the first opener.
-        Since another process is still using it, we will use the file size */
-      DEBUG(0,("WARNING smb_shm_open : filesize (%.0f) != expected size (%.0f), using filesize\n",
-            (double)filesize, (double)size));
+    }
 
-      size = filesize;
-   }
-   
-   smb_shm_header_p = (struct SmbShmHeader *)mmap(NULL, size, 
-                                                 read_only?PROT_READ:
-                                                 (PROT_READ | PROT_WRITE), 
-                                                 MAP_FILE | MAP_SHARED, 
-                                                 smb_shm_fd, 0);
-   /* WARNING, smb_shm_header_p can be different for different processes mapping the same file ! */
-   if (smb_shm_header_p  == (struct SmbShmHeader *)(-1))
-   {
-      DEBUG(0,("ERROR smb_shm_open : mmap failed with code %s\n",strerror(errno)));
+    /* paranoia */
+    if(sys_lseek(smb_shm_fd,0,SEEK_SET) == -1)
+    {
+      DEBUG(0,("ERROR smb_shm_open : sys_lseek failed with code %s\n",
+            strerror(errno)));
       smb_shm_unregister_process(smb_shm_processreg_name, getpid());
       smb_shm_global_unlock();
       close(smb_shm_fd);
       return NULL;
-   }      
+    }
+
+    filesize = size;
+  }
+   
+  if (size != filesize )
+  {
+    /* the existing file has a different size and we are not the first opener.
+      Since another process is still using it, we will use the file size */
+    DEBUG(0,("WARNING smb_shm_open : filesize (%.0f) != expected \
+size (%.0f), using filesize\n", (double)filesize, (double)size));
+
+    size = filesize;
+  }
+   
+  smb_shm_header_p = (struct SmbShmHeader *)mmap(NULL, size, 
+                               read_only?PROT_READ: (PROT_READ | PROT_WRITE), 
+                               MAP_FILE | MAP_SHARED, smb_shm_fd, 0);
+
+  /* 
+   * WARNING, smb_shm_header_p can be different for different
+   * processes mapping the same file !
+   */
+  if (smb_shm_header_p  == (struct SmbShmHeader *)(-1))
+  {
+    DEBUG(0,("ERROR smb_shm_open : mmap failed with code %s\n",strerror(errno)));
+    smb_shm_unregister_process(smb_shm_processreg_name, getpid());
+    smb_shm_global_unlock();
+    close(smb_shm_fd);
+    return NULL;
+  }      
    
       
-   if (!read_only && (created_new || !other_processes))
-   {
-      smb_shm_initialize(size);
-      /* Create the hash buckets for the share file entries. */
-      smb_shm_create_hash_table(SHMEM_HASH_SIZE);
-   }
-   else if (!smb_shm_validate_header(size) )
-   {
-      /* existing file is corrupt, samba admin should remove it by hand */
-      DEBUG(0,("ERROR smb_shm_open : corrupt shared mem file, remove it manually\n"));
-      munmap((caddr_t)smb_shm_header_p, size);
-      smb_shm_unregister_process(smb_shm_processreg_name, getpid());
-      smb_shm_global_unlock();
-      close(smb_shm_fd);
-      return NULL;
-   }
+  if (!read_only && (created_new || !other_processes))
+  {
+    smb_shm_initialize(size);
+    /* Create the hash buckets for the share file entries. */
+    smb_shm_create_hash_table(SHMEM_HASH_SIZE);
+  }
+  else if (!smb_shm_validate_header(size) )
+  {
+    /* existing file is corrupt, samba admin should remove it by hand */
+    DEBUG(0,("ERROR smb_shm_open : corrupt shared mem file, remove it manually\n"));
+    munmap((caddr_t)smb_shm_header_p, size);
+    smb_shm_unregister_process(smb_shm_processreg_name, getpid());
+    smb_shm_global_unlock();
+    close(smb_shm_fd);
+    return NULL;
+  }
    
-   smb_shm_global_unlock();
-   return &shmops;
+  smb_shm_global_unlock();
+  return &shmops;
 }
 
 

diff --git a/source/smbd/connection.c b/source/smbd/connection.c
index 0170fa54972a46274e4d580c7f4ea42e667d8e69..af74e40f6a5608ed69a5a6a244cdbbef90fe5eff 100644 (file)
--- a/source/smbd/connection.c
+++ b/source/smbd/connection.c
@@ -166,7 +166,11 @@ BOOL claim_connection(connection_struct *conn,char *name,int max_connections,BOO
                }
                
                if (Clear && crec.pid && !process_exists(crec.pid)) {
-                       sys_lseek(fd,i*sizeof(crec),SEEK_SET);
+                       if(sys_lseek(fd,i*sizeof(crec),SEEK_SET) != i*sizeof(crec)) {
+              DEBUG(0,("claim_connection: ERROR: sys_lseek failed to seek \
+to %d\n", i*sizeof(crec) ));
+              continue;
+            }
                        bzero((void *)&crec,sizeof(crec));
                        write(fd, &crec,sizeof(crec));
                        if (foundi < 0) foundi = i;

diff --git a/source/smbd/fileio.c b/source/smbd/fileio.c
index ebc4544a7699485e71bc8e5260f4db1b676b277d..c7ffb6412dd677b00d4bafaea1f35a3548fdc9c2 100644 (file)
--- a/source/smbd/fileio.c
+++ b/source/smbd/fileio.c
@@ -31,11 +31,20 @@ seek a file. Try to avoid the seek if possible
 SMB_OFF_T seek_file(files_struct *fsp,SMB_OFF_T pos)
 {
   SMB_OFF_T offset = 0;
+  SMB_OFF_T seek_ret;
 
   if (fsp->print_file && lp_postscript(fsp->conn->service))
     offset = 3;
 
-  fsp->pos = (sys_lseek(fsp->fd_ptr->fd,pos+offset,SEEK_SET) - offset);
+  seek_ret = sys_lseek(fsp->fd_ptr->fd,pos+offset,SEEK_SET);
+
+  if((seek_ret == -1) || (seek_ret != pos+offset)) {
+    DEBUG(0,("seek_file: sys_lseek failed. Error was %s\n", strerror(errno) ));
+    fsp->pos = -1;
+    return -1;
+  }
+
+  fsp->pos = seek_ret - offset;
 
   DEBUG(10,("seek_file: requested pos = %.0f, new pos = %.0f\n",
         (double)(pos+offset), (double)fsp->pos ));
@@ -75,7 +84,7 @@ ssize_t read_file(files_struct *fsp,char *data,SMB_OFF_T pos,size_t n)
   }
 #endif
 
-  if (seek_file(fsp,pos) != pos) {
+  if (seek_file(fsp,pos) == -1) {
     DEBUG(3,("read_file: Failed to seek to %.0f\n",(double)pos));
     return(ret);
   }

diff --git a/source/smbd/reply.c b/source/smbd/reply.c
index d801ce4a630488a1ac52c23c348aeaf91a2a53a7..bcb408c2a697deff7805beb28c3b36858af58ad6 100644 (file)
--- a/source/smbd/reply.c
+++ b/source/smbd/reply.c
@@ -1844,6 +1844,7 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
   
 #if UNSAFE_READRAW
   {
+    BOOL seek_fail = False;
     int predict=0;
     _smb_setlen(header,nread);
 
@@ -1852,11 +1853,18 @@ int reply_readbraw(connection_struct *conn, char *inbuf, char *outbuf, int dum_s
       predict = read_predict(fsp->fd_ptr->fd,startpos,header+4,NULL,nread);
 #endif /* USE_READ_PREDICTION */
 
-    if ((nread-predict) > 0)
-      seek_file(fsp,startpos + predict);
-    
-    ret = (ssize_t)transfer_file(fsp->fd_ptr->fd,Client,(SMB_OFF_T)(nread-predict),header,4+predict,
-                       startpos+predict);
+    if ((nread-predict) > 0) {
+      if(seek_file(fsp,startpos + predict) == -1) {
+        DEBUG(0,("reply_readbraw: ERROR: seek_file failed.\n"));
+        ret = 0;
+        seek_fail = True;
+      } 
+    }
+
+    if(!seek_fail)
+      ret = (ssize_t)transfer_file(fsp->fd_ptr->fd,Client,
+                                   (SMB_OFF_T)(nread-predict),header,4+predict, 
+                                   startpos+predict);
   }
 
   if (ret != nread+4)
@@ -2065,8 +2073,10 @@ int reply_writebraw(connection_struct *conn, char *inbuf,char *outbuf, int dum_s
   if (is_locked(fsp,conn,tcount,startpos, F_WRLCK))
     return(ERROR(ERRDOS,ERRlock));
 
-  if (seek_file(fsp,startpos) != startpos)
+  if (seek_file(fsp,startpos) == -1) {
     DEBUG(0,("couldn't seek to %.0f in writebraw\n",(double)startpos));
+    return(UNIXERROR(ERRDOS,ERRnoaccess));
+  }
 
   if (numtowrite>0)
     nwritten = write_file(fsp,data,numtowrite);
@@ -2153,7 +2163,8 @@ int reply_writeunlock(connection_struct *conn, char *inbuf,char *outbuf, int dum
   if (is_locked(fsp,conn,numtowrite,startpos, F_WRLCK))
     return(ERROR(ERRDOS,ERRlock));
 
-  seek_file(fsp,startpos);
+  if(seek_file(fsp,startpos) == -1)
+    return(UNIXERROR(ERRDOS,ERRnoaccess));
 
   /* The special X/Open SMB protocol handling of
      zero length writes is *NOT* done for
@@ -2205,7 +2216,8 @@ int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int dum_size,i
   if (is_locked(fsp,conn,numtowrite,startpos, F_WRLCK))
     return(ERROR(ERRDOS,ERRlock));
 
-  seek_file(fsp,startpos);
+  if(seek_file(fsp,startpos) == -1)
+    return(UNIXERROR(ERRDOS,ERRnoaccess));
 
   /* X/Open SMB protocol says that if smb_vwv1 is
      zero then the file size should be extended or
@@ -2272,7 +2284,8 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng
   if (is_locked(fsp,conn,numtowrite,startpos, F_WRLCK))
     return(ERROR(ERRDOS,ERRlock));
 
-  seek_file(fsp,startpos);
+  if(seek_file(fsp,startpos) == -1)
+    return(UNIXERROR(ERRDOS,ERRnoaccess));
   
   /* X/Open SMB protocol says that, unlike SMBwrite
      if the length is zero then NO truncation is
@@ -2331,7 +2344,9 @@ int reply_lseek(connection_struct *conn, char *inbuf,char *outbuf, int dum_size,
       umode = SEEK_SET; break;
   }
 
-  res = sys_lseek(fsp->fd_ptr->fd,startpos,umode);
+  if((res = sys_lseek(fsp->fd_ptr->fd,startpos,umode)) == -1)
+    return(UNIXERROR(ERRDOS,ERRnoaccess));
+
   fsp->pos = res;
   
   outsize = set_message(outbuf,2,0,True);
@@ -2469,7 +2484,8 @@ int reply_writeclose(connection_struct *conn,
        if (is_locked(fsp,conn,numtowrite,startpos, F_WRLCK))
                return(ERROR(ERRDOS,ERRlock));
       
-       seek_file(fsp,startpos);
+       if(seek_file(fsp,startpos) == -1)
+               return(UNIXERROR(ERRDOS,ERRnoaccess));
       
        nwritten = write_file(fsp,data,numtowrite);
 
@@ -3312,7 +3328,7 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
 {
   int Access,action;
   SMB_STRUCT_STAT st;
-  int ret=0;
+  int ret=-1;
   files_struct *fsp1,*fsp2;
   pstring dest;
   
@@ -3357,7 +3373,15 @@ static BOOL copy_file(char *src,char *dest1,connection_struct *conn, int ofun,
   }
 
   if ((ofun&3) == 1) {
-    sys_lseek(fsp2->fd_ptr->fd,0,SEEK_END);
+    if(sys_lseek(fsp2->fd_ptr->fd,0,SEEK_END) == -1) {
+      DEBUG(0,("copy_file: error - sys_lseek returned error %s\n",
+               strerror(errno) ));
+      /*
+       * Stop the copy from occurring.
+       */
+      ret = -1;
+      st.st_size = 0;
+    }
   }
   
   if (st.st_size)
@@ -3807,7 +3831,9 @@ int reply_writebmpx(connection_struct *conn, char *inbuf,char *outbuf, int dum_s
   if (is_locked(fsp,conn,tcount,startpos,F_WRLCK))
     return(ERROR(ERRDOS,ERRlock));
 
-  seek_file(fsp,startpos);
+  if(seek_file(fsp,startpos) == -1)
+    return(UNIXERROR(ERRDOS,ERRnoaccess));
+
   nwritten = write_file(fsp,data,numtowrite);
 
   if(lp_syncalways(SNUM(conn)) || write_through)
@@ -3909,7 +3935,18 @@ int reply_writebs(connection_struct *conn, char *inbuf,char *outbuf, int dum_siz
   if(wbms->wr_discard)
     return -1; /* Just discard the packet */
 
-  seek_file(fsp,startpos);
+  if(seek_file(fsp,startpos) == -1)
+  {
+    if(write_through)
+    {
+      /* We are returning an error - we can delete the aux struct */
+      if (wbms) free((char *)wbms);
+      fsp->wbmpx_ptr = NULL;
+      return(UNIXERROR(ERRDOS,ERRnoaccess));
+    }
+    return(CACHE_ERROR(wbms,ERRDOS,ERRnoaccess));
+  } 
+
   nwritten = write_file(fsp,data,numtowrite);
 
   if(lp_syncalways(SNUM(conn)) || write_through)

diff --git a/source/smbd/trans2.c b/source/smbd/trans2.c
index f9186115f56c365ec9b10a535493366045042ff8..62bfb612e5a33733996c437061fd71d212dd6cc0 100644 (file)
--- a/source/smbd/trans2.c
+++ b/source/smbd/trans2.c
@@ -1253,7 +1253,8 @@ static int call_trans2qfilepathinfo(connection_struct *conn,
       DEBUG(3,("fstat of fnum %d failed (%s)\n",fsp->fnum, strerror(errno)));
       return(UNIXERROR(ERRDOS,ERRbadfid));
     }
-    pos = sys_lseek(fsp->fd_ptr->fd,0,SEEK_CUR);
+    if((pos = sys_lseek(fsp->fd_ptr->fd,0,SEEK_CUR)) == -1)
+      return(UNIXERROR(ERRDOS,ERRnoaccess));
   } else {
     /* qpathinfo */
     info_level = SVAL(params,0);