From 067596477a1efb2ea1e063384c50f907b0570fb5 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 27 Mar 2017 10:46:47 -0700 Subject: [PATCH] s3: smbd: Fix incorrect logic exposed by fix for the security bug 12496 (CVE-2017-2619). In a UNIX filesystem, the names "." and ".." by definition can *never* be symlinks - they are already reserved names. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721 Signed-off-by: Jeremy Allison --- source3/smbd/vfs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c index 35f560b8676..5133fe5c2fd 100644 --- a/source3/smbd/vfs.c +++ b/source3/smbd/vfs.c @@ -1307,8 +1307,11 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname) /* fname can't have changed in resolved_path. */ const char *p = &resolved_name[rootdir_len]; - /* *p can be '\0' if fname was "." */ - if (*p == '\0' && ISDOT(fname)) { + /* + * UNIX filesystem semantics, names consisting + * only of "." or ".." CANNOT be symlinks. + */ + if (ISDOT(fname) || ISDOTDOT(fname)) { goto out; } -- 2.12.1.578.ge9c3154ca4-goog