diff options
| author | Ralph Boehme <slow@samba.org> | 2018-07-17 15:40:04 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2018-07-28 06:16:15 +0200 |
| commit | 066ba51aac130fbd67fe728a692a08ddabbc6ef8 (patch) | |
| tree | 6d85a32e9ee12fcb288bdecb469a7d7f92b3b4dd | |
| parent | 0c373043eb13506e92728e2b7ce360b32f401160 (diff) | |
| download | samba-066ba51aac130fbd67fe728a692a08ddabbc6ef8.tar.gz | |
s3: smbd: fix path check in smbd_smb2_create_durable_lease_check()
Bug: https://bugzilla.samba.org/show_bug.cgi?id=13535
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit e60e9368cb3cb512e2506620d814187a692108e0)
| -rw-r--r-- | selftest/knownfail.d/samba3.smb2.durable-v2-open | 1 | ||||
| -rw-r--r-- | source3/smbd/smb2_create.c | 16 |
2 files changed, 15 insertions, 2 deletions
diff --git a/selftest/knownfail.d/samba3.smb2.durable-v2-open b/selftest/knownfail.d/samba3.smb2.durable-v2-open deleted file mode 100644 index facf1d0b543..00000000000 --- a/selftest/knownfail.d/samba3.smb2.durable-v2-open +++ /dev/null @@ -1 +0,0 @@ -^samba3.smb2.durable-v2-open.reopen2-lease-v2\(nt4_dc\)$ diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c index 26df7180acb..55ddb754d83 100644 --- a/source3/smbd/smb2_create.c +++ b/source3/smbd/smb2_create.c @@ -381,6 +381,7 @@ static NTSTATUS smbd_smb2_create_durable_lease_check(struct smb_request *smb1req const char *requested_filename, const struct files_struct *fsp, const struct smb2_lease *lease_ptr) { + char *filename = NULL; struct smb_filename *smb_fname = NULL; uint32_t ucf_flags; NTSTATUS status; @@ -407,10 +408,23 @@ static NTSTATUS smbd_smb2_create_durable_lease_check(struct smb_request *smb1req return NT_STATUS_OBJECT_NAME_NOT_FOUND; } + filename = talloc_strdup(talloc_tos(), requested_filename); + if (filename == NULL) { + return NT_STATUS_NO_MEMORY; + } + + /* This also converts '\' to '/' */ + status = check_path_syntax(filename); + if (!NT_STATUS_IS_OK(status)) { + TALLOC_FREE(filename); + return status; + } + ucf_flags = filename_create_ucf_flags(smb1req, FILE_OPEN); status = filename_convert(talloc_tos(), fsp->conn, - requested_filename, ucf_flags, + filename, ucf_flags, NULL, &smb_fname); + TALLOC_FREE(filename); if (!NT_STATUS_IS_OK(status)) { DEBUG(10, ("filename_convert returned %s\n", nt_errstr(status))); |