r21769: Attempt to fix bug #4384 in old search code.

We were accessing a pathname that hadn't gone
through unix_convert ! That's a big no-no...
Jeremy.
(This used to be commit 33a67fd39e1a51944bf0783350aa6ef95dfafb84)

1 files changed, 4 insertions, 14 deletions

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index f85f635d6b..a9c94b8163 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -967,16 +967,13 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 
 	if (status_len == 0) {
 		SMB_STRUCT_STAT sbuf;
-		pstring dir2;
 
 		pstrcpy(directory,path);
-		pstrcpy(dir2,path);
 		nt_status = unix_convert(conn, directory, True, NULL, &sbuf);
 		if (!NT_STATUS_IS_OK(nt_status)) {
 			END_PROFILE(SMBsearch);
 			return ERROR_NT(nt_status);
 		}
-		unix_format(dir2);
 
 		nt_status = check_name(conn, directory);
 		if (!NT_STATUS_IS_OK(nt_status)) {
@@ -984,23 +981,16 @@ int reply_search(connection_struct *conn, char *inbuf,char *outbuf, int dum_size
 			return ERROR_NT(nt_status);
 		}
 
-		p = strrchr_m(dir2,'/');
-		if (p == NULL) {
-			pstrcpy(mask,dir2);
-			*dir2 = 0;
-		} else {
-			*p = 0;
-			pstrcpy(mask,p+1);
-		}
-
 		p = strrchr_m(directory,'/');
 		if (!p) {
-			*directory = 0;
+			pstrcpy(mask,directory);
+			pstrcpy(directory,".");
 		} else {
 			*p = 0;
+			pstrcpy(mask,p+1);
 		}
 
-		if (strlen(directory) == 0) {
+		if (*directory == '\0') {
 			pstrcpy(directory,".");
 		}
 		memset((char *)status,'\0',21);