s4:dsdb/descriptor: the old nTSecurityDescriptor is always expected there on modify

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>

diff --git a/source4/dsdb/samdb/ldb_modules/descriptor.c b/source4/dsdb/samdb/ldb_modules/descriptor.c
index 4b4704b6641fd70496b287a3862f272b9c2902b8..96bc356485490f0c2db91e2ae67cb4e28d9ad1fc 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/descriptor.c
+++ b/source4/dsdb/samdb/ldb_modules/descriptor.c
@@ -714,6 +714,9 @@ static int descriptor_modify(struct ldb_module *module, struct ldb_request *req)
        }
 
        old_sd = ldb_msg_find_ldb_val(current_res->msgs[0], "nTSecurityDescriptor");
+       if (old_sd == NULL) {
+               return ldb_operr(ldb);
+       }
 
        sd = get_new_descriptor(module, dn, req,
                                objectclass, parent_sd,