s3:smbd: as check_path_syntax() changes the string, we need to copy the string before

metze

diff --git a/source3/smbd/smb2_create.c b/source3/smbd/smb2_create.c
index 707b014388450b1355d04a1ef968f82a61fdb328..fe414bb8979ea5c62e0fca51ff80312494175508 100644 (file)
--- a/source3/smbd/smb2_create.c
+++ b/source3/smbd/smb2_create.c
@@ -315,14 +315,20 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                }
                info = FILE_WAS_CREATED;
        } else {
+               char *fname;
                struct smb_filename *smb_fname = NULL;
 
                /* these are ignored for SMB2 */
                in_create_options &= ~(0x10);/* NTCREATEX_OPTIONS_SYNC_ALERT */
                in_create_options &= ~(0x20);/* NTCREATEX_OPTIONS_ASYNC_ALERT */
 
+               fname = talloc_strdup(state, in_name);
+               if (tevent_req_nomem(fname, req)) {
+                       return tevent_req_post(req, ev);
+               }
+
                /* convert '\\' into '/' */
-               status = check_path_syntax(in_name);
+               status = check_path_syntax(fname);
                if (!NT_STATUS_IS_OK(status)) {
                        tevent_req_nterror(req, status);
                        return tevent_req_post(req, ev);
@@ -331,7 +337,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                status = filename_convert(req,
                                          smbreq->conn,
                                          smbreq->flags2 & FLAGS2_DFS_PATHNAMES,
-                                         in_name,
+                                         fname,
                                          0,
                                          NULL,
                                          &smb_fname);