s3:smb2_ioctl: add some more validation checks

Based on a patch from Christian Ambach <ambi@samba.org>.

metze

The last 2 patches address bug #9058 - Files not deleted, smbstatus shows
"Segmentation fault".

diff --git a/source3/smbd/smb2_ioctl.c b/source3/smbd/smb2_ioctl.c
index d545cd3e8ac136153524901f71983206ce5f4fdb..e869839f2ed496bc5cd2d906c68915a798776a4d 100644 (file)
--- a/source3/smbd/smb2_ioctl.c
+++ b/source3/smbd/smb2_ioctl.c
@@ -89,15 +89,34 @@ NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
        in_input_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
        in_input_buffer.length = in_input_length;
 
-       if (in_file_id_persistent == UINT64_MAX &&
-                  in_file_id_volatile == UINT64_MAX) {
-               /* without a handle */
-       } else {
+       switch (in_ctl_code) {
+       case FSCTL_DFS_GET_REFERRALS:
+       case FSCTL_DFS_GET_REFERRALS_EX:
+       case FSCTL_PIPE_WAIT:
+       case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
+       case FSCTL_VALIDATE_NEGOTIATE_INFO:
+       case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
+               /*
+                * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
+                * FSCTL_PIPE_WAIT does not take a file handle.
+                *
+                * If FileId in the SMB2 Header of the request is not
+                * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
+                * with STATUS_INVALID_PARAMETER.
+                */
+               if (in_file_id_persistent != UINT64_MAX ||
+                   in_file_id_volatile != UINT64_MAX) {
+                       return smbd_smb2_request_error(req,
+                               NT_STATUS_INVALID_PARAMETER);
+               }
+               break;
+       default:
                in_fsp = file_fsp_smb2(req, in_file_id_persistent,
                                        in_file_id_volatile);
                if (in_fsp == NULL) {
                        return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
                }
+               break;
        }
 
        subreq = smbd_smb2_ioctl_send(req,