give out file handles differently on each new connection because of a

common bug in MS clients where they try to reuse a file descriptor
from an earlier smb connection. This code increases the chance that
the errant client will get an error rather than causing corruption

diff --git a/source/smbd/server.c b/source/smbd/server.c
index 15258e02eaf90b116b5865f5acc50b742c0d7dba..bf66e1ca4bee0de210df9c4e8bdfa9281c9a6abb 100644 (file)
--- a/source/smbd/server.c
+++ b/source/smbd/server.c
@@ -3630,16 +3630,35 @@ int make_connection(char *service,char *user,char *password, int pwlen, char *de
 ****************************************************************************/
 int find_free_file(void )
 {
-  int i;
-  /* returning a file handle of 0 is a bad idea - so we start at 1 */
-  for (i=1;i<MAX_OPEN_FILES;i++)
-         if (!Files[i].open) {
-                 /* paranoia */
-                 memset(&Files[i], 0, sizeof(Files[i]));
-                 return(i);
-         }
-  DEBUG(1,("ERROR! Out of file structures - perhaps increase MAX_OPEN_FILES?\n"));
-  return(-1);
+       int i;
+       static int first_file;
+
+       /* we want to give out file handles differently on each new
+          connection because of a common bug in MS clients where they try to
+          reuse a file descriptor from an earlier smb connection. This code
+          increases the chance that the errant client will get an error rather
+          than causing corruption */
+       if (first_file == 0) {
+               first_file = (getpid() ^ (int)time(NULL)) % MAX_OPEN_FILES;
+               if (first_file == 0) first_file = 1;
+       }
+
+       for (i=first_file;i<MAX_OPEN_FILES;i++)
+               if (!Files[i].open) {
+                       memset(&Files[i], 0, sizeof(Files[i]));
+                       return(i);
+               }
+
+       /* returning a file handle of 0 is a bad idea - so we start at 1 */
+       for (i=1;i<first_file;i++)
+               if (!Files[i].open) {
+                       memset(&Files[i], 0, sizeof(Files[i]));
+                       return(i);
+               }
+
+
+       DEBUG(1,("ERROR! Out of file structures - perhaps increase MAX_OPEN_FILES?\n"));
+       return(-1);
 }
 
 /****************************************************************************