2 files changed, 63 insertions, 8 deletions

diff --git a/source3/smbd/conn.c b/source3/smbd/conn.c
index e899af1319..125277be21 100644
--- a/source3/smbd/conn.c
+++ b/source3/smbd/conn.c
@@ -63,10 +63,10 @@ bool conn_snum_used(int snum)
 	return(False);
 }
 
-
 /****************************************************************************
-find a conn given a cnum
+ Find a conn given a cnum.
 ****************************************************************************/
+
 connection_struct *conn_find(unsigned cnum)
 {
 	int count=0;
@@ -84,6 +84,27 @@ connection_struct *conn_find(unsigned cnum)
 	return NULL;
 }
 
+/****************************************************************************
+ Find a conn given a service name.
+****************************************************************************/
+
+connection_struct *conn_find_byname(const char *service)
+{
+	int count=0;
+	connection_struct *conn;
+
+	for (conn=Connections;conn;conn=conn->next,count++) {
+		if (strequal(lp_servicename(SNUM(conn)),service)) {
+			if (count > 10) {
+				DLIST_PROMOTE(Connections, conn);
+			}
+			return conn;
+		}
+	}
+
+	return NULL;
+}
+
 
 /****************************************************************************
   find first available connection slot, starting from a random position.
diff --git a/source3/smbd/msdfs.c b/source3/smbd/msdfs.c
index e321a8c8e4..04b9b7deaa 100644
--- a/source3/smbd/msdfs.c
+++ b/source3/smbd/msdfs.c
@@ -49,6 +49,7 @@ static NTSTATUS parse_dfs_path(const char *pathname,
 {
 	char *pathname_local;
 	char *p,*temp;
+	char *servicename;
 	char *eos_ptr;
 	NTSTATUS status = NT_STATUS_OK;
 	char sepchar;
@@ -128,16 +129,49 @@ static NTSTATUS parse_dfs_path(const char *pathname,
 	DEBUG(10,("parse_dfs_path: hostname: %s\n",pdp->hostname));
 
 	/* Parse out servicename. */
-	temp = p+1;
-	p = strchr_m(temp,sepchar);
+	servicename = p+1;
+	p = strchr_m(servicename,sepchar);
+	if (p) {
+		*p = '\0';
+	}
+
+	/* Is this really our servicename ? */
+	if (NULL == conn_find_byname(servicename)) {
+		DEBUG(10,("parse_dfs_path: %s is not our servicename\n",
+			servicename));
+
+		/*
+		 * Possibly client sent a local path by mistake.
+		 * Try and convert to a local path.
+		 */
+
+		pdp->hostname = eos_ptr; /* "" */
+		pdp->servicename = eos_ptr; /* "" */
+
+		/* Repair the path - replace the sepchar's
+		   we nulled out */
+		servicename--;
+		*servicename = sepchar;
+		if (p) {
+			*p = sepchar;
+		}
+
+		p = temp;
+		DEBUG(10,("parse_dfs_path: trying to convert %s "
+			"to a local path\n",
+			temp));
+		goto local_path;
+	}
+
+	pdp->servicename = servicename;
+
+	DEBUG(10,("parse_dfs_path: servicename: %s\n",pdp->servicename));
+
 	if(p == NULL) {
-		pdp->servicename = temp;
+		/* Client sent self referral \server\share. */
 		pdp->reqpath = eos_ptr; /* "" */
 		return NT_STATUS_OK;
 	}
-	*p = '\0';
-	pdp->servicename = temp;
-	DEBUG(10,("parse_dfs_path: servicename: %s\n",pdp->servicename));
 
 	p++;