From 68be9a820059ee96dd26c527efd7c14e679d3f2c Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Thu, 15 Nov 2007 14:19:52 -0800
Subject: More pstring removal. This one was tricky. I had to add one horror
 (pstring_clean_name()) which will have to remain until I've removed all
 pstrings from the client code. Jeremy. (This used to be commit
 1ea3ac80146b83c2522b69e7747c823366a2b47d)

---
 source3/rpc_server/srv_srvsvc_nt.c | 21 +++++++++++++--------
 source3/rpc_server/srv_winreg_nt.c | 27 ++++++++++++++-------------
 2 files changed, 27 insertions(+), 21 deletions(-)

(limited to 'source3/rpc_server')

diff --git a/source3/rpc_server/srv_srvsvc_nt.c b/source3/rpc_server/srv_srvsvc_nt.c
index 5a3c451cde..51dffb8904 100644
--- a/source3/rpc_server/srv_srvsvc_nt.c
+++ b/source3/rpc_server/srv_srvsvc_nt.c
@@ -1463,17 +1463,22 @@ WERROR _srv_net_share_get_info(pipes_struct *p, SRV_Q_NET_SHARE_GET_INFO *q_u, S
  Check a given DOS pathname is valid for a share.
 ********************************************************************/
 
-char *valid_share_pathname(char *dos_pathname)
+char *valid_share_pathname(TALLOC_CTX *ctx, const char *dos_pathname)
 {
-	char *ptr;
+	char *ptr = talloc_strdup(ctx, dos_pathname);
 
+	if (!ptr) {
+		return NULL;
+	}
 	/* Convert any '\' paths to '/' */
-	unix_format(dos_pathname);
-	unix_clean_name(dos_pathname);
+	unix_format(ptr);
+	ptr = unix_clean_name(talloc_tos(), ptr);
+	if (!ptr) {
+		return NULL;
+	}
 
 	/* NT is braindead - it wants a C: prefix to a pathname ! So strip it. */
-	ptr = dos_pathname;
-	if (strlen(dos_pathname) > 2 && ptr[1] == ':' && ptr[0] != '/')
+	if (strlen(ptr) > 2 && ptr[1] == ':' && ptr[0] != '/')
 		ptr += 2;
 
 	/* Only absolute paths allowed. */
@@ -1602,7 +1607,7 @@ WERROR _srv_net_share_set_info(pipes_struct *p, SRV_Q_NET_SHARE_SET_INFO *q_u, S
 		return WERR_ACCESS_DENIED;
 		
 	/* Check if the pathname is valid. */
-	if (!(path = valid_share_pathname( pathname )))
+	if (!(path = valid_share_pathname(p->mem_ctx, pathname )))
 		return WERR_OBJECT_PATH_INVALID;
 
 	/* Ensure share name, pathname and comment don't contain '"' characters. */
@@ -1774,7 +1779,7 @@ WERROR _srv_net_share_add(pipes_struct *p, SRV_Q_NET_SHARE_ADD *q_u, SRV_R_NET_S
 		return WERR_ACCESS_DENIED;
 		
 	/* Check if the pathname is valid. */
-	if (!(path = valid_share_pathname( pathname )))
+	if (!(path = valid_share_pathname(p->mem_ctx, pathname )))
 		return WERR_OBJECT_PATH_INVALID;
 
 	/* Ensure share name, pathname and comment don't contain '"' characters. */
diff --git a/source3/rpc_server/srv_winreg_nt.c b/source3/rpc_server/srv_winreg_nt.c
index ce34211420..4b268dda19 100644
--- a/source3/rpc_server/srv_winreg_nt.c
+++ b/source3/rpc_server/srv_winreg_nt.c
@@ -580,17 +580,16 @@ WERROR _winreg_AbortSystemShutdown(pipes_struct *p, struct winreg_AbortSystemShu
 	
 	if ( can_shutdown )
 		become_root();
-		
+
 	ret = smbrun( abort_shutdown_script, NULL );
-	
+
 	if ( can_shutdown )
 		unbecome_root();
-		
+
 	/********** END SeRemoteShutdownPrivilege BLOCK **********/
 
 	DEBUG(3,("_reg_abort_shutdown: Running the command `%s' gave %d\n",
 		abort_shutdown_script, ret));
-		
 
 	return (ret == 0) ? WERR_OK : WERR_ACCESS_DENIED;
 }
@@ -605,19 +604,19 @@ static int validate_reg_filename( pstring fname )
 	int snum;
 	pstring share_path;
 	pstring unix_fname;
-	
+
 	/* convert to a unix path, stripping the C:\ along the way */
-	
-	if ( !(p = valid_share_pathname( fname ) ))
+
+	if ( !(p = valid_share_pathname(NULL, fname)))
 		return -1;
 
 	/* has to exist within a valid file share */
-			
+
 	for ( snum=0; snum<num_services; snum++ ) {
-	
+
 		if ( !lp_snum_ok(snum) || lp_print_ok(snum) )
 			continue;
-		
+
 		pstrcpy( share_path, lp_pathname(snum) );
 
 		/* make sure we have a path (e.g. [homes] ) */
@@ -628,12 +627,14 @@ static int validate_reg_filename( pstring fname )
 		if ( strncmp( share_path, p, strlen( share_path )) == 0 )
 			break;
 	}
-	
+
 	/* p and fname are overlapping memory so copy out and back in again */
-	
+
 	pstrcpy( unix_fname, p );
 	pstrcpy( fname, unix_fname );
-	
+
+	TALLOC_FREE(p);
+
 	return (snum < num_services) ? snum : -1;
 }
 
-- 
cgit