From e7a8e4e6433bf26f6eac46e6a5f65f421a8981bb Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@samba.org>
Date: Wed, 12 Dec 2018 10:08:53 +0100
Subject: [PATCH] libcli:security: Do not duplicate invalid aces

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
---
 libcli/security/security_descriptor.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libcli/security/security_descriptor.c b/libcli/security/security_descriptor.c
index 0a2bb952b0e..02c3212fa63 100644
--- a/libcli/security/security_descriptor.c
+++ b/libcli/security/security_descriptor.c
@@ -58,6 +58,10 @@ struct security_acl *security_acl_dup(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
+	if (oacl->aces == NULL && oacl->num_aces > 0) {
+		return NULL;
+	}
+
 	nacl = talloc (mem_ctx, struct security_acl);
 	if (nacl == NULL) {
 		return NULL;