From 42fd34aa5ee1ad60b4593a1cddeaba4a5dbc2ea6 Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Mon, 27 Mar 2017 10:46:47 -0700 Subject: [PATCH] s3: smbd: Fix incorrect logic exposed by fix for the security bug 12496 (CVE-2017-2619). In a UNIX filesystem, the names "." and ".." by definition can *never* be symlinks - they are already reserved names. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12721 Signed-off-by: Jeremy Allison Reviewed-by: Uri Simchoni (cherry picked from commit ae17bebd250bdde5614b2ac17e53512f19fe9b68) --- source3/smbd/vfs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/source3/smbd/vfs.c b/source3/smbd/vfs.c index 45562eedebe..a7368372f14 100644 --- a/source3/smbd/vfs.c +++ b/source3/smbd/vfs.c @@ -1307,8 +1307,11 @@ NTSTATUS check_reduced_name(connection_struct *conn, const char *fname) /* fname can't have changed in resolved_path. */ const char *p = &resolved_name[rootdir_len]; - /* *p can be '\0' if fname was "." */ - if (*p == '\0' && ISDOT(fname)) { + /* + * UNIX filesystem semantics, names consisting + * only of "." or ".." CANNOT be symlinks. + */ + if (ISDOT(fname) || ISDOTDOT(fname)) { goto out; } -- 2.11.4.GIT