CVE-2021-44141: s3: smbd: Handling SMB_FILE_RENAME_INFORMATION, the destination name...

No errors should be allowed from filename_convert().

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14911

Signed-off-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 2b2643b6325083b3532bc17d504e36f4af65a8d1..95a7cc63970b74cc25a25ddd250ac1317ca2680f 100644 (file)
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -7477,25 +7477,8 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
                                          0,
                                          &smb_fname_dst);
 
-               /* If an error we expect this to be
-                * NT_STATUS_OBJECT_PATH_NOT_FOUND */
-
                if (!NT_STATUS_IS_OK(status)) {
-                       if(!NT_STATUS_EQUAL(NT_STATUS_OBJECT_PATH_NOT_FOUND,
-                                           status)) {
-                               goto out;
-                       }
-                       /* Create an smb_fname to call rename_internals_fsp() */
-                       smb_fname_dst = synthetic_smb_fname(ctx,
-                                               base_name,
-                                               NULL,
-                                               NULL,
-                                               smb_fname_src->twrp,
-                                               smb_fname_src->flags);
-                       if (smb_fname_dst == NULL) {
-                               status = NT_STATUS_NO_MEMORY;
-                               goto out;
-                       }
+                       goto out;
                }
                dst_original_lcomp = get_original_lcomp(smb_fname_dst,
                                        conn,