@@ -1706,7 +1706,8 @@ recursiveCopyCheckSymlink(PUNICODE_STRING src, bool& isdirlink)
17061706 Create a deep copy of src as dst, while avoiding descending in origpath.
17071707*/
17081708static int
1709- recursiveCopy (PUNICODE_STRING src, PUNICODE_STRING dst, PCWSTR origpath, PWIN32_FIND_DATAW dHfile = NULL )
1709+ recursiveCopy (PUNICODE_STRING src, PUNICODE_STRING dst, USHORT origsrclen,
1710+ USHORT origdstlen, PWIN32_FIND_DATAW dHfile = NULL )
17101711{
17111712 HANDLE dH = INVALID_HANDLE_VALUE;
17121713 NTSTATUS status;
@@ -1801,11 +1802,15 @@ recursiveCopy (PUNICODE_STRING src, PUNICODE_STRING dst, PCWSTR origpath, PWIN32
18011802 if ((dHfile->dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) && !isdirlink)
18021803 {
18031804 /* Recurse into the child directory */
1804- debug_printf (" %S <-> %W" , src, origpath);
1805- // avoids endless recursion
1806- if (wcsncmp (src->Buffer , origpath, src->Length / sizeof (WCHAR)))
1807- if (recursiveCopy (src, dst, origpath, dHfile))
1805+ /* avoids endless recursion */
1806+ if (src->Length <= origsrclen ||
1807+ !wcsncmp (src->Buffer , dst->Buffer , origdstlen / sizeof (WCHAR)))
1808+ {
1809+ set_errno (ELOOP);
18081810 goto done;
1811+ }
1812+ if (recursiveCopy (src, dst, origsrclen, origdstlen, dHfile))
1813+ goto done;
18091814 }
18101815 else
18111816 {
@@ -2419,14 +2424,13 @@ symlink_worker (const char *oldpath, path_conv &win32_newpath, bool isdevice)
24192424 w_newpath->Buffer [1 ] = L' \\ ' ;
24202425 if (win32_oldpath.isdir ())
24212426 {
2422- PWCHAR origpath =
2423- win32_oldpath.get_wide_win32_path (tp.w_get ());
24242427 /* we need a larger UNICODE_STRING MaximumLength than
24252428 get_nt_native_path allocates for the recursive copy */
24262429 UNICODE_STRING u_oldpath, u_newpath;
24272430 RtlCopyUnicodeString (tp.u_get (&u_oldpath), w_oldpath);
24282431 RtlCopyUnicodeString (tp.u_get (&u_newpath), w_newpath);
2429- res = recursiveCopy (&u_oldpath, &u_newpath, origpath);
2432+ res = recursiveCopy (&u_oldpath, &u_newpath,
2433+ u_oldpath.Length , u_newpath.Length );
24302434 }
24312435 else
24322436 {
0 commit comments