From: Jeremy Allison <jra@samba.org>
Date: Tue, 5 Jan 2016 19:18:12 +0000 (-0800)
Subject: CVE-2015-7560: s3: smbd: Add refuse_symlink() function that can be used to prevent... 
X-Git-Tag: tdb-1.3.9~440
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b551cd83ef74340adaf88629a9ee9fa5c5215ec6;p=thirdparty%2Fsamba.git

CVE-2015-7560: s3: smbd: Add refuse_symlink() function that can be used to prevent operations on a symlink.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11648

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Michael Adam <obnox@samba.org>
---

diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index b1eb9a9d2af..43eeb492d23 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -54,6 +54,34 @@ static char *store_file_unix_basic_info2(connection_struct *conn,
 				files_struct *fsp,
 				const SMB_STRUCT_STAT *psbuf);
 
+/****************************************************************************
+ Check if an open file handle or pathname is a symlink.
+****************************************************************************/
+
+static NTSTATUS refuse_symlink(connection_struct *conn,
+			const files_struct *fsp,
+			const char *name)
+{
+	SMB_STRUCT_STAT sbuf;
+	const SMB_STRUCT_STAT *pst = NULL;
+
+	if (fsp) {
+		pst = &fsp->fsp_name->st;
+	} else {
+		int ret = vfs_stat_smb_basename(conn,
+				name,
+				&sbuf);
+		if (ret == -1) {
+			return map_nt_error_from_unix(errno);
+		}
+		pst = &sbuf;
+	}
+	if (S_ISLNK(pst->st_ex_mode)) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	return NT_STATUS_OK;
+}
+
 NTSTATUS check_access_fsp(const struct files_struct *fsp,
 			  uint32_t access_mask)
 {