Samba 3.3.6 seems to fail the smbtorture4 smb2.create leading-slash test

[Jeremy Allison]

On Mon, Nov 05, 2012 at 03:37:27PM -0800, Richard Sharpe wrote:
> On Mon, Nov 5, 2012 at 3:25 PM, Jeremy Allison <jra at samba.org> wrote:
> > On Mon, Nov 05, 2012 at 03:12:43PM -0800, Richard Sharpe wrote:
> >> Hi folks,
> >>
> >> This is what we see, at least on FreeBSD:
> >>
> >> failure: leading-slash [
> >> (../source4/torture/smb2/create.c:1083) Incorrect status NT_STATUS_OK - should
> >> be NT_STATUS_INVALID_PARAMETER
> >> ]
> >
> > ../source4/torture/smb2/create.c:1083 doesn't match any test in the master
> > or v4-0-test source code.
> >
> > What smbtorture are you using ?
> 
> Heh, I copied that straight out of a bug report. QA build that some
> time ago. It seems to be off by one in the 3.6.6 source tree I have an
> d is line 1172 in master from late last week
> (test_smb2_leading_slash).

I think this should fix it for 3.6.x. Patch for master and 4.0.0 also included.

Jeremy.
-------------- next part --------------
diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c
index 5a9044d..544fb76 100644
--- a/source3/smbd/smb2_create.c
+++ b/source3/smbd/smb2_create.c
@@ -220,6 +220,12 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
 		return smbd_smb2_request_error(smb2req, NT_STATUS_OBJECT_NAME_INVALID);
 	}
 
+	if (in_name_string_size) {
+		if (in_name_string[0] == '/' || in_name_string[0] == '\\') {
+			return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
+		}
+	}
+
 	ZERO_STRUCT(in_context_blobs);
 	status = smb2_create_blob_parse(smb2req, in_context_buffer, &in_context_blobs);
 	if (!NT_STATUS_IS_OK(status)) {
-------------- next part --------------
diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c
index 812d9db..a7ce014 100644
--- a/source3/smbd/smb2_create.c
+++ b/source3/smbd/smb2_create.c
@@ -222,6 +222,12 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
 		return smbd_smb2_request_error(smb2req, NT_STATUS_OBJECT_NAME_INVALID);
 	}
 
+	if (in_name_string_size) {
+		if (in_name_string[0] == '/' || in_name_string[0] == '\\') {
+			return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
+		}
+	}
+
 	ZERO_STRUCT(in_context_blobs);
 	status = smb2_create_blob_parse(smb2req, in_context_buffer, &in_context_blobs);
 	if (!NT_STATUS_IS_OK(status)) {