system/wine
system/wine
1
0
Fork 0
mirror of git://source.winehq.org/git/wine.git synced 2024-10-04 17:34:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

server: Prevent infinite symlink recursion in lookup_named_object().

Browse source 
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
This commit is contained in:
Alexandre Julliard 2022-07-05 14:33:55 +02:00
parent 248231468d
commit 9c551448cb
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
server/object.c
View file

@ -233,6 +233,7 @@ static void free_object( struct object *obj )
struct object *lookup_named_object( struct object *root, const struct unicode_str *name,
unsigned int attr, struct unicode_str *name_left )
{
static int recursion_count;
struct object *obj, *parent;
struct unicode_str name_tmp = *name, *ptr = &name_tmp;
@ -261,6 +262,13 @@ struct object *lookup_named_object( struct object *root, const struct unicode_st
if (!name_tmp.len) ptr = NULL; /* special case for empty path */
if (recursion_count > 32)
{
set_error( STATUS_INVALID_PARAMETER );
release_object( parent );
return NULL;
}
recursion_count++;
clear_error();
while ((obj = parent->ops->lookup_name( parent, ptr, attr, root )))
@ -269,6 +277,8 @@ struct object *lookup_named_object( struct object *root, const struct unicode_st
release_object ( parent );
parent = obj;
}
recursion_count--;
if (get_error())
{
release_object( parent );