From f70ac2e25847e41ecf54ae9d66e3247e1996b152 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 24 Sep 2007 19:11:42 +0000 Subject: r25309: Volker's fix for bug #4984 - samba4 torture test to follow. Ensure we don't prepend "./" as a root directory - this is an invalid pathname for unix_convert(). Jeremy. --- source/smbd/nttrans.c | 112 ++++++++++++++++++++++++++++++++------------------ 1 file changed, 71 insertions(+), 41 deletions(-) (limited to 'source/smbd/nttrans.c') diff --git a/source/smbd/nttrans.c b/source/smbd/nttrans.c index dce0d6188d9..e69fd86995d 100644 --- a/source/smbd/nttrans.c +++ b/source/smbd/nttrans.c @@ -586,7 +586,6 @@ void reply_ntcreate_and_X(connection_struct *conn, char *rel_fname = NULL; files_struct *dir_fsp = file_fsp( SVAL(req->inbuf, smb_ntcreate_RootDirectoryFid)); - size_t dir_name_len; if(!dir_fsp) { reply_doserror(req, ERRDOS, ERRbadfid); @@ -629,29 +628,46 @@ void reply_ntcreate_and_X(connection_struct *conn, return; } - /* - * Copy in the base directory name. - */ + if (ISDOT(dir_fsp->fsp_name)) { + /* + * We're at the toplevel dir, the final file name + * must not contain ./, as this is filtered out + * normally by srvstr_get_path and unix_convert + * explicitly rejects paths containing ./. + */ + fname = talloc_strdup(ctx,""); + if (!fname) { + reply_nterror(req, NT_STATUS_NO_MEMORY); + END_PROFILE(SMBntcreateX); + return; + } + } else { + size_t dir_name_len = strlen(dir_fsp->fsp_name); - dir_name_len = strlen(dir_fsp->fsp_name); - fname = TALLOC_ARRAY(ctx, char, dir_name_len+2); - if (!fname) { - reply_nterror( - req, NT_STATUS_NO_MEMORY); - END_PROFILE(SMBntcreateX); - return; - } - memcpy(fname, dir_fsp->fsp_name, dir_name_len+1); + /* + * Copy in the base directory name. + */ - /* - * Ensure it ends in a '/'. - * We used TALLOC_SIZE +2 to add space for the '/'. - */ + fname = TALLOC_ARRAY(ctx, char, dir_name_len+2); + if (!fname) { + reply_nterror( + req, NT_STATUS_NO_MEMORY); + END_PROFILE(SMBntcreateX); + return; + } + memcpy(fname, dir_fsp->fsp_name, dir_name_len+1); + + /* + * Ensure it ends in a '/'. + * We used TALLOC_SIZE +2 to add space for the '/'. + */ - if(dir_name_len && (fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) { - fname[dir_name_len] = '/'; - fname[dir_name_len+1] = '\0'; - dir_name_len++; + if(dir_name_len && + (fname[dir_name_len-1] != '\\') && + (fname[dir_name_len-1] != '/')) { + fname[dir_name_len] = '/'; + fname[dir_name_len+1] = '\0'; + } } srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &rel_fname, @@ -1356,7 +1372,6 @@ static void call_nt_transact_create(connection_struct *conn, */ char *tmpname = NULL; files_struct *dir_fsp = file_fsp(SVAL(params,4)); - size_t dir_name_len; if(!dir_fsp) { reply_doserror(req, ERRDOS, ERRbadfid); @@ -1387,28 +1402,43 @@ static void call_nt_transact_create(connection_struct *conn, return; } - /* - * Copy in the base directory name. - */ + if (ISDOT(dir_fsp->fsp_name)) { + /* + * We're at the toplevel dir, the final file name + * must not contain ./, as this is filtered out + * normally by srvstr_get_path and unix_convert + * explicitly rejects paths containing ./. + */ + fname = talloc_strdup(ctx,""); + if (!fname) { + reply_nterror(req, NT_STATUS_NO_MEMORY); + return; + } + } else { + size_t dir_name_len = strlen(dir_fsp->fsp_name); - dir_name_len = strlen(dir_fsp->fsp_name); - fname = TALLOC_ARRAY(ctx, char, dir_name_len+2); - if (!fname) { - reply_nterror( - req, NT_STATUS_NO_MEMORY); - return; - } - memcpy(fname, dir_fsp->fsp_name, dir_name_len+1); + /* + * Copy in the base directory name. + */ - /* - * Ensure it ends in a '/'. - * We used TALLOC_SIZE +2 to add space for the '/'. - */ + fname = TALLOC_ARRAY(ctx, char, dir_name_len+2); + if (!fname) { + reply_nterror(req, NT_STATUS_NO_MEMORY); + return; + } + memcpy(fname, dir_fsp->fsp_name, dir_name_len+1); + + /* + * Ensure it ends in a '/'. + * We used TALLOC_SIZE +2 to add space for the '/'. + */ - if(dir_name_len && (fname[dir_name_len-1] != '\\') && (fname[dir_name_len-1] != '/')) { - fname[dir_name_len] = '/'; - fname[dir_name_len+1] = '\0'; - dir_name_len++; + if(dir_name_len && + (fname[dir_name_len-1] != '\\') && + (fname[dir_name_len-1] != '/')) { + fname[dir_name_len] = '/'; + fname[dir_name_len+1] = '\0'; + } } srvstr_get_path(ctx, params, req->flags2, &tmpname, -- cgit