(applying fix to 1.9.18)

this is a proper fix for the find_free_file/oplock bug. Files[]
elements are now marked reserved while the open is taking place and
find_free_file() does not allow a reserved file to be opened
The reservation is removed if the open fails or in close_file()

1 files changed, 10 insertions, 6 deletions

diff --git a/source/smbd/server.c b/source/smbd/server.c
index 82e163fadd4..1b4f6f35d0f 100644
--- a/source/smbd/server.c
+++ b/source/smbd/server.c
@@ -1466,6 +1466,8 @@ void close_file(int fnum, BOOL normal_close)
   uint32 inode = fs_p->fd_ptr->inode;
   int token;
 
+  Files[fnum].reserved = False;
+
 #if USE_READ_PREDICTION
   invalidate_read_prediction(fs_p->fd_ptr->fd);
 #endif
@@ -3671,21 +3673,23 @@ int find_free_file(void )
 		if (first_file == 0) first_file = 1;
 	}
 
-	if (first_file == MAX_OPEN_FILES)
-		first_file = 0;
+	if (first_file >= MAX_OPEN_FILES)
+		first_file = 1;
 
 	for (i=first_file;i<MAX_OPEN_FILES;i++)
-		if (!Files[i].open) {
+		if (!Files[i].open && !Files[i].reserved) {
 			memset(&Files[i], 0, sizeof(Files[i]));
-			first_file++;
+			first_file = i+1;
+			Files[i].reserved = True;
 			return(i);
 		}
 
 	/* returning a file handle of 0 is a bad idea - so we start at 1 */
 	for (i=1;i<first_file;i++)
-		if (!Files[i].open) {
+		if (!Files[i].open && !Files[i].reserved) {
 			memset(&Files[i], 0, sizeof(Files[i]));
-			first_file++;
+			first_file = i+1;
+			Files[i].reserved = True;
 			return(i);
 		}