Code:  smb2_flush(smb_request_t *sr)
 {
	smb_ofile_t *of = NULL;
 	uint16_t StructSize;
 	uint16_t reserved1;
 	uint32_t reserved2;
	smb2fid_t smb2fid;
	uint32_t status;
	int rc = 0;

	/*
	 * SMB2 Flush request
	 */
	rc = smb_mbc_decodef(
	    &sr->smb_data, "wwlqq",
	    &StructSize,		/* w */
	    &reserved1,			/* w */
	    &reserved2,			/* l */
	    &smb2fid.persistent,	/* q */
	    &smb2fid.temporal);		/* q */
	if (rc)
		return (SDRC_ERROR);
	if (StructSize != 24)
		return (SDRC_ERROR);

	status = smb2sr_lookup_fid(sr, &smb2fid);
	if (status) {
 		smb2sr_put_error(sr, status);
 		return (SDRC_SUCCESS);
 	}
	of = sr->fid_ofile;
 
	/*
	 * XXX - todo:
	 * Flush named pipe should drain writes.
	 */
	if ((of->f_node->flags & NODE_FLAGS_WRITE_THROUGH) == 0)
		(void) smb_fsop_commit(sr, of->f_cr, of->f_node);
 
 	/*
 	 * SMB2 Flush reply
	 */
	(void) smb_mbc_encodef(
	    &sr->reply, "wwl",
	    4,	/* StructSize */	/* w */
	    0); /* reserved */		/* w */

	return (SDRC_SUCCESS);
}

Vulnerability Type: 
CWE ID: CWE-476
Summary: illumos smbsrv NULL pointer dereference allows system crash.
Commit Message: 7483 SMB flush on pipe triggers NULL pointer dereference in module smbsrv
Reviewed by: Gordon Ross <gwr@nexenta.com>
Reviewed by: Matt Barden <matt.barden@nexenta.com>
Reviewed by: Evan Layton <evan.layton@nexenta.com>
Reviewed by: Dan McDonald <danmcd@omniti.com>
Approved by: Gordon Ross <gwr@nexenta.com>