smbd: Protect smbd_smb2_getinfo_send() against invalid quota files

[samba.git] / source3 / smbd / smb2_getinfo.c

diff --git a/source3/smbd/smb2_getinfo.c b/source3/smbd/smb2_getinfo.c
index 01aedbf8e2e2e0961f0da4160e8cf731f9d68f97..f4fb7ce0b231f660ca8e0c774de642858692f803 100644 (file)
--- a/source3/smbd/smb2_getinfo.c
+++ b/source3/smbd/smb2_getinfo.c
@@ -547,12 +547,21 @@ static struct tevent_req *smbd_smb2_getinfo_send(TALLOC_CTX *mem_ctx,
                struct ndr_pull *ndr_pull = NULL;
                DATA_BLOB sid_buf = data_blob_null;
                TALLOC_CTX *tmp_ctx = talloc_init("geninfo_quota");
+               bool ok;
 
                if (!tmp_ctx) {
                        tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                        return tevent_req_post(req, ev);
                }
 
+               ok = check_fsp_ntquota_handle(conn, smbreq, fsp);
+               if (!ok) {
+                       DBG_INFO("no valid QUOTA HANDLE\n");
+                       TALLOC_FREE(tmp_ctx);
+                       tevent_req_nterror(req, NT_STATUS_INVALID_HANDLE);
+                       return tevent_req_post(req, ev);
+               }
+
                ndr_pull = ndr_pull_init_blob(&in_input_buffer, tmp_ctx);
                if (!ndr_pull) {
                        TALLOC_FREE(tmp_ctx);