Fix coredump from Samba4 torture suite.

Jeremy.

diff --git a/source/smbd/files.c b/source/smbd/files.c
index 1fe6f250e526b3803429fcc00aede6b07f6feaad..80544c9a3095261b6d8113f98d5b68a8af0ce1bd 100644 (file)
--- a/source/smbd/files.c
+++ b/source/smbd/files.c
@@ -405,6 +405,8 @@ files_struct *file_fsp(char *buf, int where)
        if (chain_fsp)
                return chain_fsp;
 
+       if (!buf)
+               return NULL;
        fnum = SVAL(buf, where);
 
        for (fsp=Files;fsp;fsp=fsp->next, count++) {

diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c
index f8bd3ae15f1b12c3b4011f38accb3544c77b9a36..1c50744947231b3839d24859ede36fe4fd4ccbd8 100644 (file)
--- a/source/smbd/nttrans.c
+++ b/source/smbd/nttrans.c
@@ -1472,6 +1472,9 @@ static int call_nt_transact_notify_change(connection_struct *conn, char *inbuf,
        files_struct *fsp;
        uint32 flags;
 
+        if(setup_count < 6)
+               return ERROR_DOS(ERRDOS,ERRbadfunc);
+
        fsp = file_fsp(setup,4);
        flags = IVAL(setup, 0);