svn commit: samba r6976 - in trunk/source/smbd: .

[jra at samba.org]

Author: jra
Date: 2005-05-25 19:25:25 +0000 (Wed, 25 May 2005)
New Revision: 6976

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=6976

Log:
Fix bug #2735 (not mangling control characters) plus
ensure we don't create files with control characters
either.
Jeremy.

Modified:
   trunk/source/smbd/mangle_hash.c
   trunk/source/smbd/mangle_hash2.c
   trunk/source/smbd/reply.c


Changeset:
Modified: trunk/source/smbd/mangle_hash.c
===================================================================
--- trunk/source/smbd/mangle_hash.c	2005-05-25 19:16:18 UTC (rev 6975)
+++ trunk/source/smbd/mangle_hash.c	2005-05-25 19:25:25 UTC (rev 6976)
@@ -95,6 +95,10 @@
 	}
 
 	while (*s) {
+		if (*s <= 0x1f) {
+			/* Control characters. */
+			return NT_STATUS_UNSUCCESSFUL;
+		}
 		switch(*s) {
 			case UCS2_CHAR('\\'):
 			case UCS2_CHAR('/'):

Modified: trunk/source/smbd/mangle_hash2.c
===================================================================
--- trunk/source/smbd/mangle_hash2.c	2005-05-25 19:16:18 UTC (rev 6975)
+++ trunk/source/smbd/mangle_hash2.c	2005-05-25 19:25:25 UTC (rev 6976)
@@ -633,6 +633,11 @@
 	memset(char_flags, 0, sizeof(char_flags));
 
 	for (i=1;i<128;i++) {
+		if (i <= 0x1f) {
+			/* Control characters. */
+			char_flags[i] |= FLAG_ILLEGAL;
+		}
+
 		if ((i >= '0' && i <= '9') || 
 		    (i >= 'a' && i <= 'z') || 
 		    (i >= 'A' && i <= 'Z')) {

Modified: trunk/source/smbd/reply.c
===================================================================
--- trunk/source/smbd/reply.c	2005-05-25 19:16:18 UTC (rev 6975)
+++ trunk/source/smbd/reply.c	2005-05-25 19:25:25 UTC (rev 6976)
@@ -118,6 +118,9 @@
 		}
 
 		if (!(*s & 0x80)) {
+			if (*s <= 0x1f) {
+				return NT_STATUS_OBJECT_NAME_INVALID;
+			}
 			switch (*s) {
 				case '*':
 				case '?':
@@ -244,6 +247,9 @@
 		}
 
 		if (!(*s & 0x80)) {
+			if (*s <= 0x1f) {
+				return NT_STATUS_OBJECT_NAME_INVALID;
+			}
 			*d++ = *s++;
 		} else {
 			switch(next_mb_char_size(s)) {