s3: smbd: fix path check in smbd_smb2_create_durable_lease_check()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=13535

Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit e60e9368cb3cb512e2506620d814187a692108e0)

diff --git a/selftest/knownfail.d/samba3.smb2.durable-v2-open b/selftest/knownfail.d/samba3.smb2.durable-v2-open
deleted file mode 100644 (file)
index facf1d0..0000000
--- a/selftest/knownfail.d/samba3.smb2.durable-v2-open
+++ /dev/null
@@ -1 +0,0 @@
-^samba3.smb2.durable-v2-open.reopen2-lease-v2\(nt4_dc\)$

diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c
index 3f38af5dde27a55d6434f589c9290eff4d6479f6..16a02f42ea3dcb68c7df100b28b91a16f76b7039 100644 (file)
--- a/source3/smbd/smb2_create.c
+++ b/source3/smbd/smb2_create.c
@@ -381,6 +381,7 @@ static NTSTATUS smbd_smb2_create_durable_lease_check(struct smb_request *smb1req
        const char *requested_filename, const struct files_struct *fsp,
        const struct smb2_lease *lease_ptr)
 {
+       char *filename = NULL;
        struct smb_filename *smb_fname = NULL;
        uint32_t ucf_flags;
        NTSTATUS status;
@@ -407,10 +408,23 @@ static NTSTATUS smbd_smb2_create_durable_lease_check(struct smb_request *smb1req
                return NT_STATUS_OBJECT_NAME_NOT_FOUND;
        }
 
+       filename = talloc_strdup(talloc_tos(), requested_filename);
+       if (filename == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       /* This also converts '\' to '/' */
+       status = check_path_syntax(filename);
+       if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(filename);
+               return status;
+       }
+
        ucf_flags = filename_create_ucf_flags(smb1req, FILE_OPEN);
        status = filename_convert(talloc_tos(), fsp->conn,
-                                 requested_filename, ucf_flags,
+                                 filename, ucf_flags,
                                  NULL, &smb_fname);
+       TALLOC_FREE(filename);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(10, ("filename_convert returned %s\n",
                           nt_errstr(status)));