Alexandre Julliard : server: Prevent infinite symlink recursion in lookup_named_object().

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 9c551448cbfb0627abd2fdd332f511dbe2de4201
URL:    https://source.winehq.org/git/wine.git/?a=commit;h=9c551448cbfb0627abd2fdd33...

Author: Alexandre Julliard 
Date:   Tue Jul  5 14:33:55 2022 +0200

server: Prevent infinite symlink recursion in lookup_named_object().

Signed-off-by: Alexandre Julliard

---

server/object.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server/object.c b/server/object.c
index 5bb999d1fc7..333f9e7b5d6 100644
--- a/server/object.c
+++ b/server/object.c
@@ -233,6 +233,7 @@ static void free_object( struct object *obj )
 struct object *lookup_named_object( struct object *root, const struct unicode_str *name,
                                     unsigned int attr, struct unicode_str *name_left )
 {
+    static int recursion_count;
     struct object *obj, *parent;
     struct unicode_str name_tmp = *name, *ptr = &name_tmp;

@@ -261,6 +262,13 @@ struct object *lookup_named_object( struct object *root, const struct unicode_st

if (!name_tmp.len) ptr = NULL;  /* special case for empty path */

+    if (recursion_count > 32)
+    {
+        set_error( STATUS_INVALID_PARAMETER );
+        release_object( parent );
+        return NULL;
+    }
+    recursion_count++;
     clear_error();

while ((obj = parent->ops->lookup_name( parent, ptr, attr, root )))
@@ -269,6 +277,8 @@ struct object *lookup_named_object( struct object *root, const struct unicode_st
         release_object ( parent );
         parent = obj;
     }
+
+    recursion_count--;
     if (get_error())
     {
         release_object( parent );