ntquotas: support "freeing" an empty quota list

This avoids dereferencing a null pointer if there's
an attempt to free an empty list.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12307

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/libsmb/cliquota.c b/source3/libsmb/cliquota.c
index 778fefcd8658321686bab3dcaf82385b246efddc..a2c6edd5f9512f36cfc33f37bc88e957c4aa0f68 100644 (file)
--- a/source3/libsmb/cliquota.c
+++ b/source3/libsmb/cliquota.c
@@ -34,8 +34,9 @@ NTSTATUS cli_get_quota_handle(struct cli_state *cli, uint16_t *quota_fnum)
 
 void free_ntquota_list(SMB_NTQUOTA_LIST **qt_list)
 {
-       if (!qt_list)
+       if (!qt_list || !*qt_list) {
                return;
+       }
 
        if ((*qt_list)->mem_ctx)
                talloc_destroy((*qt_list)->mem_ctx);

diff --git a/source3/smbd/ntquotas.c b/source3/smbd/ntquotas.c
index 9b2e39a72bf8e1e0d702f693202fcd5268388fb9..93f4a2ae12fe905cd886ffdb4480d6ef072648e9 100644 (file)
--- a/source3/smbd/ntquotas.c
+++ b/source3/smbd/ntquotas.c
@@ -231,8 +231,7 @@ int vfs_get_user_ntquota_list(files_struct *fsp, SMB_NTQUOTA_LIST **qt_list)
 
 static int quota_handle_destructor(SMB_NTQUOTA_HANDLE *handle)
 {
-       if (handle->quota_list)
-               free_ntquota_list(&handle->quota_list);
+       free_ntquota_list(&handle->quota_list);
        return 0;
 }