smbd: Fix read_symlink_reparse()

Bug: https://bugzilla.samba.org/show_bug.cgi?id=15505

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Oct 27 21:19:35 UTC 2023 on atb-devel-224

(cherry picked from commit 952d6c2cf48b19807e96a49b95c19c224bd6e732)

Autobuild-User(v4-19-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-19-test): Mon Dec 11 09:45:32 UTC 2023 on atb-devel-224

diff --git a/source3/smbd/files.c b/source3/smbd/files.c
index 9dcab463d3b1be755cfafa95f5b14edfbc70e8ea..b8640fd6677049ced1c1dd3afd354b1a3e0c36a5 100644 (file)
--- a/source3/smbd/files.c
+++ b/source3/smbd/files.c
@@ -754,11 +754,19 @@ NTSTATUS read_symlink_reparse(
        }
 
        if (symlink->substitute_name[0] == '/') {
-               const char *connectpath = dirfsp->conn->connectpath;
+               char *subdir_path = NULL;
                char *abs_target_canon = NULL;
                const char *relative = NULL;
                bool in_share;
 
+               subdir_path = talloc_asprintf(talloc_tos(),
+                                             "%s/%s",
+                                             dirfsp->conn->connectpath,
+                                             dirfsp->fsp_name->base_name);
+               if (subdir_path == NULL) {
+                       goto nomem;
+               }
+
                abs_target_canon =
                        canonicalize_absolute_path(talloc_tos(),
                                                   symlink->substitute_name);
@@ -766,8 +774,8 @@ NTSTATUS read_symlink_reparse(
                        goto nomem;
                }
 
-               in_share = subdir_of(connectpath,
-                                    strlen(connectpath),
+               in_share = subdir_of(subdir_path,
+                                    strlen(subdir_path),
                                     abs_target_canon,
                                     &relative);
                if (in_share) {