Re: [PATCH] smb: client: validate absolute native symlink targets before NT fixups

[Namjae Jeon]

On Fri, Sep 11, 2026 at 3:41 AM Jérémy Jean
<Jeremy.Jean@xxxxxxxxxxxxxxxxx> wrote:
>
> With symlinkroot unset, an absolute target is copied without conversion
> to an NT drive path. Later code still assumes an NT prefix is present
> when modifying the target and calculating the print name length.
>
> For "/ab", this causes two failures: sym[5] and path[5] are written
> past their allocations, and plen -= 2 * poff subtracts an assumed
> 8-byte prefix from a 6-byte UTF-16 target, wrapping u16 plen to 65534.
> That underflow causes another overflow: memcpy() copies 65534 bytes
> into a 24-byte buffer. A user with write access to a mounted share
> can trigger these bugs with default settings.
>
> Validate the NT drive prefix, including an ASCII drive letter, before
> accessing fixed offsets or subtracting the prefix length.
>
> Fixes: 3363da82e02f ("smb: client: fix native SMB symlink traversal")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
Reviewed-by: Namjae Jeon <linkinjeon@xxxxxxxxxx>
Thanks.