From 01b8638f08d1646da0d64111cf96f2819eee1891 Mon Sep 17 00:00:00 2001
From: Hartmut Birr <osexpert@googlemail.com>
Date: Sun, 18 Jan 2004 22:31:23 +0000
Subject: [PATCH] - Check for illegal dot sequences in file and path names.

svn path=/trunk/; revision=7754
---
 reactos/drivers/fs/vfat/create.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/reactos/drivers/fs/vfat/create.c b/reactos/drivers/fs/vfat/create.c
index a9f10e62235..5ecf1cc935c 100644
--- a/reactos/drivers/fs/vfat/create.c
+++ b/reactos/drivers/fs/vfat/create.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: create.c,v 1.65 2003/11/27 20:49:07 gdalsnes Exp $
+/* $Id: create.c,v 1.66 2004/01/18 22:31:23 hbirr Exp $
  *
  * PROJECT:          ReactOS kernel
  * FILE:             drivers/fs/vfat/create.c
@@ -446,9 +446,10 @@ VfatCreateFile (PDEVICE_OBJECT DeviceObject, PIRP Irp)
   ULONG RequestedDisposition, RequestedOptions;
   PVFATCCB pCcb;
   PVFATFCB pFcb;
-  PWCHAR c;
+  PWCHAR c, last;
   BOOLEAN PagingFileCreate = FALSE;
   LARGE_INTEGER AllocationSize;
+  BOOLEAN Dots;
   
   /* Unpack the various parameters. */
   Stack = IoGetCurrentIrpStackLocation (Irp);
@@ -498,12 +499,28 @@ VfatCreateFile (PDEVICE_OBJECT DeviceObject, PIRP Irp)
     }
 
   /*
-   * Check for illegal characters in the file name
+   * Check for illegal characters and illegale dot sequences in the file name
    */
   c = FileObject->FileName.Buffer + FileObject->FileName.Length / sizeof(WCHAR);
+  last = c - 1;
+  Dots = TRUE;
   while (c-- > FileObject->FileName.Buffer)
     {
-      if (*c != '\\' && vfatIsLongIllegal(*c))
+      if (*c == L'\\' || c == FileObject->FileName.Buffer)
+        {
+	  if (Dots && last > c)
+	    {
+              return(STATUS_OBJECT_NAME_INVALID);
+	    }
+	  last = c - 1;
+	  Dots = TRUE;
+	}
+      else if (*c != L'.')
+        {
+	  Dots = FALSE;
+	}
+
+      if (*c != '\\' && vfatIsLongIllegal(*c)) 
         {
           return(STATUS_OBJECT_NAME_INVALID);
 	}