s3:smbd:smb2: fix segfault (access after free) in durable disconnect code

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Tue Feb 19 11:12:01 CET 2013 on sn-devel-104

diff --git a/source3/smbd/close.c b/source3/smbd/close.c
index df3ae23a92ae526afe3cb1167e42e037b62464fd..d0c843ea9cc9c981d8c013be386f162daca4cc4e 100644 (file)
--- a/source3/smbd/close.c
+++ b/source3/smbd/close.c
@@ -782,6 +782,7 @@ static NTSTATUS close_normal_file(struct smb_request *req, files_struct *fsp,
                        data_blob_free(&fsp->op->global->backend_cookie);
                        fsp->op->global->backend_cookie = new_cookie;
 
+                       fsp->op->compat = NULL;
                        tmp = smbXsrv_open_close(fsp->op, now);
                        if (!NT_STATUS_IS_OK(tmp)) {
                                DEBUG(1, ("Failed to update smbXsrv_open "

diff --git a/source3/smbd/smbXsrv_open.c b/source3/smbd/smbXsrv_open.c
index c1754e86b2ef777c9338982940aca2a2f6f94038..be39cbc3972c25146a9cdd09569fdbb4c4e9f48b 100644 (file)
--- a/source3/smbd/smbXsrv_open.c
+++ b/source3/smbd/smbXsrv_open.c
@@ -1078,6 +1078,7 @@ NTSTATUS smbXsrv_open_close(struct smbXsrv_open *op, NTTIME now)
        op->db_rec = NULL;
 
        if (op->compat) {
+               op->compat->op = NULL;
                file_free(NULL, op->compat);
                op->compat = NULL;
        }