Merge branch 'master' of ssh://git.samba.org/data/git/samba

1 files changed, 49 insertions, 16 deletions

diff --git a/source4/ntvfs/posix/pvfs_resolve.c b/source4/ntvfs/posix/pvfs_resolve.c
index 1e13474b9e..f08de72a38 100644
--- a/source4/ntvfs/posix/pvfs_resolve.c
+++ b/source4/ntvfs/posix/pvfs_resolve.c
@@ -186,23 +186,49 @@ static NTSTATUS pvfs_case_search(struct pvfs_state *pvfs,
 /*
   parse a alternate data stream name
 */
-static NTSTATUS parse_stream_name(struct pvfs_filename *name, const char *s)
+static NTSTATUS parse_stream_name(struct smb_iconv_convenience *ic,
+				  struct pvfs_filename *name,
+				  const char *s)
 {
 	char *p;
+	if (s[1] == '\0') {
+		return NT_STATUS_OBJECT_NAME_INVALID;
+	}
 	name->stream_name = talloc_strdup(name, s+1);
 	if (name->stream_name == NULL) {
 		return NT_STATUS_NO_MEMORY;
 	}
-	p = strchr_m(name->stream_name, ':');
-	if (p == NULL) {
-		name->stream_id = pvfs_name_hash(name->stream_name, 
-						 strlen(name->stream_name));
-		return NT_STATUS_OK;
-	}
-	if (strcasecmp_m(p, ":$DATA") != 0) {
-		return NT_STATUS_OBJECT_NAME_INVALID;
+
+	p = name->stream_name;
+
+	while (*p) {
+		size_t c_size;
+		codepoint_t c = next_codepoint_convenience(ic, p, &c_size);
+
+		switch (c) {
+		case '/':
+		case '\\':
+			return NT_STATUS_OBJECT_NAME_INVALID;
+		case ':':
+			*p= 0;
+			p++;
+			if (*p == '\0') {
+				return NT_STATUS_OBJECT_NAME_INVALID;
+			}
+			if (strcasecmp_m(p, "$DATA") != 0) {
+				if (strchr_m(p, ':')) {
+					return NT_STATUS_OBJECT_NAME_INVALID;
+				}
+				return NT_STATUS_INVALID_PARAMETER;
+			}
+			c_size = 0;
+			p--;
+			break;
+		}
+
+		p += c_size;
 	}
-	*p = 0;
+
 	if (strcmp(name->stream_name, "") == 0) {
 		/*
 		 * we don't set stream_name to NULL, here
@@ -233,6 +259,7 @@ static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
 			       uint_t flags, struct pvfs_filename *name)
 {
 	char *ret, *p, *p_start;
+	struct smb_iconv_convenience *ic = NULL;
 	NTSTATUS status;
 
 	name->original_name = talloc_strdup(name, cifs_name);
@@ -263,15 +290,21 @@ static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
 	   for legal characters */
 	p_start = p;
 
+	ic = lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx);
 	while (*p) {
 		size_t c_size;
-		codepoint_t c = next_codepoint_convenience(lp_iconv_convenience(pvfs->ntvfs->ctx->lp_ctx), p, &c_size);
+		codepoint_t c = next_codepoint_convenience(ic, p, &c_size);
+
+		if (c <= 0x1F) {
+			return NT_STATUS_OBJECT_NAME_INVALID;
+		}
+
 		switch (c) {
 		case '\\':
 			if (name->has_wildcard) {
 				/* wildcards are only allowed in the last part
 				   of a name */
-				return NT_STATUS_ILLEGAL_CHARACTER;
+				return NT_STATUS_OBJECT_NAME_INVALID;
 			}
 			if (p > p_start && (p[1] == '\\' || p[1] == '\0')) {
 				/* see if it is definately a "\\" or
@@ -288,12 +321,12 @@ static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
 			break;
 		case ':':
 			if (!(flags & PVFS_RESOLVE_STREAMS)) {
-				return NT_STATUS_ILLEGAL_CHARACTER;
+				return NT_STATUS_OBJECT_NAME_INVALID;
 			}
 			if (name->has_wildcard) {
-				return NT_STATUS_ILLEGAL_CHARACTER;
+				return NT_STATUS_OBJECT_NAME_INVALID;
 			}
-			status = parse_stream_name(name, p);
+			status = parse_stream_name(ic, name, p);
 			if (!NT_STATUS_IS_OK(status)) {
 				return status;
 			}
@@ -311,7 +344,7 @@ static NTSTATUS pvfs_unix_path(struct pvfs_state *pvfs, const char *cifs_name,
 			break;
 		case '/':
 		case '|':
-			return NT_STATUS_ILLEGAL_CHARACTER;
+			return NT_STATUS_OBJECT_NAME_INVALID;
 		case '.':
 			/* see if it is definately a .. or
 			   . component. If it is then fail here, and