From: Jeremy Allison <jra@samba.org>
Date: Tue, 13 May 2008 22:02:53 +0000 (-0700)
Subject: Second part of patch for bug #5460. Cope with pathnames
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c3328a252430007cd716a406d85fd2a0bbbff607;p=thirdparty%2Fsamba.git

Second part of patch for bug #5460. Cope with pathnames
that don't look like \xxx\yyy, cope with arbitrary length.
Jeremy.
---

diff --git a/source/smbd/msdfs.c b/source/smbd/msdfs.c
index 7400f792edd..4408c635dd1 100644
--- a/source/smbd/msdfs.c
+++ b/source/smbd/msdfs.c
@@ -49,6 +49,7 @@ static NTSTATUS parse_dfs_path(const char *pathname,
 {
 	char *pathname_local;
 	char *p,*temp;
+	char *servicename;
 	char *eos_ptr;
 	NTSTATUS status = NT_STATUS_OK;
 	char sepchar;
@@ -128,25 +129,48 @@ static NTSTATUS parse_dfs_path(const char *pathname,
 	DEBUG(10,("parse_dfs_path: hostname: %s\n",pdp->hostname));
 
 	/* Parse out servicename. */
-	temp = p+1;
-	p = strchr_m(temp,sepchar);
+	servicename = p+1;
+	p = strchr_m(servicename,sepchar);
+	if (p) {
+		*p = '\0';
+	}
+
+	/* Is this really our servicename ? */
+	if (NULL == conn_find_byname(servicename)) {
+		DEBUG(10,("parse_dfs_path: %s is not our servicename\n",
+			servicename));
+
+		/*
+		 * Possibly client sent a local path by mistake.
+		 * Try and convert to a local path.
+		 */
+
+		pdp->hostname = eos_ptr; /* "" */
+		pdp->servicename = eos_ptr; /* "" */
+
+		/* Repair the path - replace the sepchar's
+		   we nulled out */
+		servicename--;
+		*servicename = sepchar;
+		if (p) {
+			*p = sepchar;
+		}
+
+		p = temp;
+		DEBUG(10,("parse_dfs_path: trying to convert %s "
+			"to a local path\n",
+			temp));
+		goto local_path;
+	}
+
+	pdp->servicename = servicename;
+
 	if(p == NULL) {
-		pdp->servicename = temp;
+		/* Client sent self referral \server\share. */
 		pdp->reqpath = eos_ptr; /* "" */
-		/* Is this really our servicename ? */
-		if (NULL == conn_find_byname(pdp->servicename)) {
-			DEBUG(10,("parse_dfs_path: %s is not our servicename\n",
-				pdp->servicename));
-			p = temp;
-			DEBUG(10,("parse_dfs_path: trying to convert %s "
-				"to a local path\n",
-				temp));
-			goto local_path;
-		}
 		return NT_STATUS_OK;
 	}
-	*p = '\0';
-	pdp->servicename = temp;
+
 	DEBUG(10,("parse_dfs_path: servicename: %s\n",pdp->servicename));
 
 	p++;