@@ -1706,7 +1706,8 @@ recursiveCopyCheckSymlink(PUNICODE_STRING src, bool& isdirlink)
1706
1706
Create a deep copy of src as dst, while avoiding descending in origpath.
1707
1707
*/
1708
1708
static int
1709
- recursiveCopy (PUNICODE_STRING src, PUNICODE_STRING dst, PCWSTR origpath, PWIN32_FIND_DATAW dHfile = NULL )
1709
+ recursiveCopy (PUNICODE_STRING src, PUNICODE_STRING dst, USHORT origsrclen,
1710
+ USHORT origdstlen, PWIN32_FIND_DATAW dHfile = NULL )
1710
1711
{
1711
1712
HANDLE dH = INVALID_HANDLE_VALUE;
1712
1713
NTSTATUS status;
@@ -1801,11 +1802,15 @@ recursiveCopy (PUNICODE_STRING src, PUNICODE_STRING dst, PCWSTR origpath, PWIN32
1801
1802
if ((dHfile->dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) && !isdirlink)
1802
1803
{
1803
1804
/* Recurse into the child directory */
1804
- debug_printf (" %S <-> %W" , src, origpath);
1805
- // avoids endless recursion
1806
- if (wcsncmp (src->Buffer , origpath, src->Length / sizeof (WCHAR)))
1807
- if (recursiveCopy (src, dst, origpath, dHfile))
1805
+ /* avoids endless recursion */
1806
+ if (src->Length <= origsrclen ||
1807
+ !wcsncmp (src->Buffer , dst->Buffer , origdstlen / sizeof (WCHAR)))
1808
+ {
1809
+ set_errno (ELOOP);
1808
1810
goto done;
1811
+ }
1812
+ if (recursiveCopy (src, dst, origsrclen, origdstlen, dHfile))
1813
+ goto done;
1809
1814
}
1810
1815
else
1811
1816
{
@@ -2419,14 +2424,13 @@ symlink_worker (const char *oldpath, path_conv &win32_newpath, bool isdevice)
2419
2424
w_newpath->Buffer [1 ] = L' \\ ' ;
2420
2425
if (win32_oldpath.isdir ())
2421
2426
{
2422
- PWCHAR origpath =
2423
- win32_oldpath.get_wide_win32_path (tp.w_get ());
2424
2427
/* we need a larger UNICODE_STRING MaximumLength than
2425
2428
get_nt_native_path allocates for the recursive copy */
2426
2429
UNICODE_STRING u_oldpath, u_newpath;
2427
2430
RtlCopyUnicodeString (tp.u_get (&u_oldpath), w_oldpath);
2428
2431
RtlCopyUnicodeString (tp.u_get (&u_newpath), w_newpath);
2429
- res = recursiveCopy (&u_oldpath, &u_newpath, origpath);
2432
+ res = recursiveCopy (&u_oldpath, &u_newpath,
2433
+ u_oldpath.Length , u_newpath.Length );
2430
2434
}
2431
2435
else
2432
2436
{
0 commit comments