give out file handles differently on each new connection because of a

common bug in MS clients where they try to reuse a file descriptor
from an earlier smb connection. This code increases the chance that
the errant client will get an error rather than causing corruption
(This used to be commit 677d7a5a13728d8207dd2e7092c98d026d2d4f3c)

diff --git a/source3/smbd/server.c b/source3/smbd/server.c
index 15258e02eaf90b116b5865f5acc50b742c0d7dba..bf66e1ca4bee0de210df9c4e8bdfa9281c9a6abb 100644 (file)
--- a/source3/smbd/server.c
+++ b/source3/smbd/server.c
@@ -3630,16 +3630,35 @@ int make_connection(char *service,char *user,char *password, int pwlen, char *de
 ****************************************************************************/
 int find_free_file(void )
 {
-  int i;
-  /* returning a file handle of 0 is a bad idea - so we start at 1 */
-  for (i=1;i<MAX_OPEN_FILES;i++)
-         if (!Files[i].open) {
-                 /* paranoia */
-                 memset(&Files[i], 0, sizeof(Files[i]));
-                 return(i);
-         }
-  DEBUG(1,("ERROR! Out of file structures - perhaps increase MAX_OPEN_FILES?\n"));
-  return(-1);
+       int i;
+       static int first_file;
+
+       /* we want to give out file handles differently on each new
+          connection because of a common bug in MS clients where they try to
+          reuse a file descriptor from an earlier smb connection. This code
+          increases the chance that the errant client will get an error rather
+          than causing corruption */
+       if (first_file == 0) {
+               first_file = (getpid() ^ (int)time(NULL)) % MAX_OPEN_FILES;
+               if (first_file == 0) first_file = 1;
+       }
+
+       for (i=first_file;i<MAX_OPEN_FILES;i++)
+               if (!Files[i].open) {
+                       memset(&Files[i], 0, sizeof(Files[i]));
+                       return(i);
+               }
+
+       /* returning a file handle of 0 is a bad idea - so we start at 1 */
+       for (i=1;i<first_file;i++)
+               if (!Files[i].open) {
+                       memset(&Files[i], 0, sizeof(Files[i]));
+                       return(i);
+               }
+
+
+       DEBUG(1,("ERROR! Out of file structures - perhaps increase MAX_OPEN_FILES?\n"));
+       return(-1);
 }
 
 /****************************************************************************