Attachment 17981 Details for Bug 15419 – Patch for master.

[patch] Patch for master.

l1 (text/plain), 1.74 KB, created by Jeremy Allison on 2023-07-14 06:24:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jeremy Allison

Created: 2023-07-14 06:24:54 UTC

Size: 1.74 KB

patch

obsolete

>diff --git a/source3/smbd/smb2_reply.c b/source3/smbd/smb2_reply.c
>index 36a863c687b..f98ad4ae04c 100644
>--- a/source3/smbd/smb2_reply.c
>+++ b/source3/smbd/smb2_reply.c
>@@ -324,6 +324,7 @@ static size_t srvstr_get_path_internal(TALLOC_CTX *ctx,
> 		char *share = NULL;
> 		char *remaining_path = NULL;
> 		char path_sep = 0;
>+		char *p = NULL;
> 
> 		if (posix_pathnames && (dst[0] == '/')) {
> 			path_sep = dst[0];
>@@ -374,6 +375,16 @@ static size_t srvstr_get_path_internal(TALLOC_CTX *ctx,
> 		if (share == NULL) {
> 			goto local_path;
> 		}
>+		/*
>+		 * Ensure the server name does not contain
>+		 * any possible UNIX path components by converting
>+		 * them to _'s.
>+		 */
>+		for (p = server + 1; p < share; p++) {
>+			if (*p == '/') {
>+				*p = '_';
>+			}
>+		}
> 		/*
> 		 * It's a well formed DFS path with
> 		 * at least server and share components.
>@@ -388,6 +399,16 @@ static size_t srvstr_get_path_internal(TALLOC_CTX *ctx,
> 		 */
> 		remaining_path = strchr(share+1, path_sep);
> 		if (remaining_path == NULL) {
>+			/*
>+			 * Ensure the share name does not contain
>+			 * any possible UNIX path components by converting
>+			 * them to _'s.
>+			 */
>+			for (p = share + 1; *p; p++) {
>+				if (*p == '/') {
>+					*p = '_';
>+				}
>+			}
> 			/*
> 			 * If no remaining path this was
> 			 * a bare /server/share path. Just return.
>@@ -395,6 +416,16 @@ static size_t srvstr_get_path_internal(TALLOC_CTX *ctx,
> 			*err = NT_STATUS_OK;
> 			return ret;
> 		}
>+		/*
>+		 * Ensure the share name does not contain
>+		 * any possible UNIX path components by converting
>+		 * them to _'s.
>+		 */
>+		for (p = share + 1; p < remaining_path; p++) {
>+			if (*p == '/') {
>+				*p = '_';
>+			}
>+		}
> 		*remaining_path = '/';
> 		dst = remaining_path + 1;
> 		/* dst now points at any following components. */

Actions: View

Attachments on bug 15419: 17980 | 17981 | 17982 | 18004 | 18005 | 18064