Re: [PATCH] smb: client: validate absolute native symlink targets before NT fixups

[Paulo Alcantara]

Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx> writes:

> With symlinkroot unset, an absolute target is copied without conversion
> to an NT drive path. Later code still assumes an NT prefix is present
> when modifying the target and calculating the print name length.
>
> For "/ab", this causes two failures: sym[5] and path[5] are written
> past their allocations, and plen -= 2 * poff subtracts an assumed
> 8-byte prefix from a 6-byte UTF-16 target, wrapping u16 plen to 65534.
> That underflow causes another overflow: memcpy() copies 65534 bytes
> into a 24-byte buffer. A user with write access to a mounted share
> can trigger these bugs with default settings.
>
> Validate the NT drive prefix, including an ASCII drive letter, before
> accessing fixed offsets or subtracting the prefix length.
> ...

Applied.