sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-06-17 15:17:09 +03:00
Code

Fix bug in old create temp SMB request. Only use VFS functions.

Browse Source 
Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: David Disseldorp <ddiss@samba.org>

Autobuild-User(master): David Disseldorp <ddiss@samba.org>
Autobuild-Date(master): Sat Apr 20 21:13:36 CEST 2013 on sn-devel-104
This commit is contained in:
Jeremy Allison 2013-04-17 14:42:20 -07:00 committed by David Disseldorp
parent 95f7fc83b2
commit 5727bfa410
1 changed files with 67 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
source3/smbd/reply.c
View File

@ -2422,13 +2422,14 @@ void reply_ctemp(struct smb_request *req)
{ {
connection_struct *conn = req->conn; connection_struct *conn = req->conn;
struct smb_filename *smb_fname = NULL; struct smb_filename *smb_fname = NULL;
char *wire_name = NULL;
char *fname = NULL; char *fname = NULL;
uint32 fattr; uint32 fattr;
files_struct *fsp; files_struct *fsp;
int oplock_request; int oplock_request;
int tmpfd;
char *s; char *s;
NTSTATUS status; NTSTATUS status;
int i;
TALLOC_CTX *ctx = talloc_tos(); TALLOC_CTX *ctx = talloc_tos();
START_PROFILE(SMBctemp); START_PROFILE(SMBctemp);
@ -2441,18 +2442,23 @@ void reply_ctemp(struct smb_request *req)
fattr = SVAL(req->vwv+0, 0); fattr = SVAL(req->vwv+0, 0);
oplock_request = CORE_OPLOCK_REQUEST(req->inbuf); oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1, srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
STR_TERMINATE, &status); STR_TERMINATE, &status);
if (!NT_STATUS_IS_OK(status)) { if (!NT_STATUS_IS_OK(status)) {
reply_nterror(req, status); reply_nterror(req, status);
goto out; goto out;
} }
if (*fname) {
for (i = 0; i < 10; i++) {
if (*wire_name) {
fname = talloc_asprintf(ctx, fname = talloc_asprintf(ctx,
"%s/TMXXXXXX", "%s/TMP%s",
fname); wire_name,
generate_random_str_list(ctx, 5, "0123456789"));
} else { } else {
fname = talloc_strdup(ctx, "TMXXXXXX"); fname = talloc_asprintf(ctx,
"TMP%s",
generate_random_str_list(ctx, 5, "0123456789"));
} }
if (!fname) { if (!fname) {
@ -2476,15 +2482,7 @@ void reply_ctemp(struct smb_request *req)
goto out; goto out;
} }
tmpfd = mkstemp(smb_fname->base_name); /* Create the file. */
if (tmpfd == -1) {
reply_nterror(req, map_nt_error_from_unix(errno));
goto out;
}
SMB_VFS_STAT(conn, smb_fname);
/* We should fail if file does not exist. */
status = SMB_VFS_CREATE_FILE( status = SMB_VFS_CREATE_FILE(
conn, /* conn */ conn, /* conn */
req, /* req */ req, /* req */
@ -2492,7 +2490,7 @@ void reply_ctemp(struct smb_request *req)
smb_fname, /* fname */ smb_fname, /* fname */
FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */ FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */ FILE_SHARE_READ | FILE_SHARE_WRITE, /* share_access */
FILE_OPEN, /* create_disposition*/ FILE_CREATE, /* create_disposition*/
0, /* create_options */ 0, /* create_options */
fattr, /* file_attributes */ fattr, /* file_attributes */
oplock_request, /* oplock_request */ oplock_request, /* oplock_request */
@ -2503,8 +2501,11 @@ void reply_ctemp(struct smb_request *req)
&fsp, /* result */ &fsp, /* result */
NULL); /* pinfo */ NULL); /* pinfo */
/* close fd from mkstemp() */ if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
close(tmpfd); TALLOC_FREE(fname);
TALLOC_FREE(smb_fname);
continue;
}
if (!NT_STATUS_IS_OK(status)) { if (!NT_STATUS_IS_OK(status)) {
if (open_was_deferred(req->sconn, req->mid)) { if (open_was_deferred(req->sconn, req->mid)) {
@ -2515,6 +2516,15 @@ void reply_ctemp(struct smb_request *req)
goto out; goto out;
} }
break;
}
if (i == 10) {
/* Collision after 10 times... */
reply_nterror(req, status);
goto out;
}
reply_outbuf(req, 1, 0); reply_outbuf(req, 1, 0);
SSVAL(req->outbuf,smb_vwv0,fsp->fnum); SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
@ -2552,6 +2562,7 @@ void reply_ctemp(struct smb_request *req)
fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode)); fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
out: out:
TALLOC_FREE(smb_fname); TALLOC_FREE(smb_fname);
TALLOC_FREE(wire_name);
END_PROFILE(SMBctemp); END_PROFILE(SMBctemp);
return; return;
} }