From: Jeremy Allison <jra@samba.org>
Date: Fri, 12 Aug 2022 06:55:58 +0000 (-0700)
Subject: s3: smbd: In get referred_path(), make sure check_path_syntax() is called on returned... 
X-Git-Tag: talloc-2.4.0~1456
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=da625e4ab4bc670e44fcb6ad7456aa64d0f1f9d2;p=thirdparty%2Fsamba.git

s3: smbd: In get referred_path(), make sure check_path_syntax() is called on returned reqpath.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15144

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c
index 1b66911faf0..19160b03c3c 100644
--- a/source3/smbd/msdfs.c
+++ b/source3/smbd/msdfs.c
@@ -1149,6 +1149,13 @@ NTSTATUS get_referred_path(TALLOC_CTX *ctx,
 		return status;
 	}
 
+	/* Path referrals are always non-POSIX. */
+	status = check_path_syntax(reqpath);
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(frame);
+		return status;
+	}
+
 	jucn->service_name = talloc_strdup(ctx, servicename);
 	jucn->volume_name = talloc_strdup(ctx, reqpath);
 	if (!jucn->service_name || !jucn->volume_name) {