CVE-2022-3592 smbd: No empty path components in openat_pathref_dirfsp_nosymlink()

Upper layers must have filtered this, everything else is a bug

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15207
Signed-off-by: Volker Lendecke <vl@samba.org>

diff --git a/source3/smbd/files.c b/source3/smbd/files.c
index 87c1f0f6301ca76123f6714942403a7c31e46034..64297f187732abba19302b66e905be408e21538e 100644 (file)
--- a/source3/smbd/files.c
+++ b/source3/smbd/files.c
@@ -817,6 +817,12 @@ NTSTATUS openat_pathref_dirfsp_nosymlink(
 
                next = strv_next(path, rel_fname.base_name);
 
+               /*
+                * Path sanitizing further up has cleaned or rejected
+                * empty path components. Assert this here.
+                */
+               SMB_ASSERT(rel_fname.base_name[0] != '\0');
+
                if (ISDOT(rel_fname.base_name) ||
                    ISDOTDOT(rel_fname.base_name)) {
                        DBG_DEBUG("%s contains a dot\n", path_in);