From 44f34b92956967884927b2729ffa37482b272812 Mon Sep 17 00:00:00 2001
From: Bill Zissimopoulos <billziss@navimatics.com>
Date: Wed, 2 Dec 2015 20:10:04 -0800
Subject: [PATCH] sys: IRP_MJ_CREATE

---
 src/sys/create.c | 24 ++++++++++++++----------
 src/sys/driver.h |  1 -
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/src/sys/create.c b/src/sys/create.c
index cd8efe23..6925bdd9 100644
--- a/src/sys/create.c
+++ b/src/sys/create.c
@@ -73,7 +73,7 @@ static NTSTATUS FspFsvolCreate(
 
     /* cannot open the volume object */
     if (0 == RelatedFileObject && 0 == FileName.Length)
-        return STATUS_ACCESS_DENIED; /* need error code like UNIX EPERM (STATUS_NOT_SUPPORTED?) */
+        return STATUS_ACCESS_DENIED; /* need error code like POSIX EPERM (STATUS_NOT_SUPPORTED?) */
 
     /* cannot open a paging file */
     if (FlagOn(Flags, SL_OPEN_PAGING_FILE))
@@ -101,7 +101,7 @@ static NTSTATUS FspFsvolCreate(
     }
 
     /* check for trailing backslash */
-    if (sizeof(WCHAR) * 2/* root can have trailing backslash */ <= FileName.Length &&
+    if (sizeof(WCHAR) * 2/* not empty or root */ <= FileName.Length &&
         L'\\' == FileName.Buffer[FileName.Length / 2 - 1])
     {
         FileName.Length -= sizeof(WCHAR);
@@ -127,35 +127,39 @@ static NTSTATUS FspFsvolCreate(
          * because RelatedFileObject->FsContext is guaranteed to exist while RelatedFileObject
          * exists.
          */
+        BOOLEAN AppendBackslash =
+            sizeof(WCHAR) * 2/* not empty or root */ <= RelatedFsContext->FileName.Length &&
+            sizeof(WCHAR) <= FileName.Length && L':' != FileName.Buffer[0];
         Result = FspFileContextCreate(
-            RelatedFsContext->FileName.Length + sizeof(WCHAR)/* backslash */ + FileName.Length,
+            RelatedFsContext->FileName.Length + AppendBackslash * sizeof(WCHAR) + FileName.Length,
             &FsContext);
         if (!NT_SUCCESS(Result))
             return Result;
 
         Result = RtlAppendUnicodeStringToString(&FsContext->FileName, &RelatedFsContext->FileName);
         ASSERT(NT_SUCCESS(Result));
-        if (HasTrailingBackslash)
+        if (AppendBackslash)
         {
             Result = RtlAppendUnicodeToString(&FsContext->FileName, L"\\");
             ASSERT(NT_SUCCESS(Result));
         }
-        Result = RtlAppendUnicodeStringToString(&FsContext->FileName, &FileName);
-        ASSERT(NT_SUCCESS(Result));
     }
     else
     {
-        /* absolute open */
+        /* must be an absolute path */
+        if (sizeof(WCHAR) <= FileName.Length && L'\\' != FileName.Buffer[0])
+            return STATUS_OBJECT_NAME_INVALID;
+
         Result = FspFileContextCreate(
             FileName.Length,
             &FsContext);
         if (!NT_SUCCESS(Result))
             return Result;
-
-        Result = RtlAppendUnicodeStringToString(&FsContext->FileName, &FileName);
-        ASSERT(NT_SUCCESS(Result));
     }
 
+    Result = RtlAppendUnicodeStringToString(&FsContext->FileName, &FileName);
+    ASSERT(NT_SUCCESS(Result));
+
     /*
      * From this point forward we MUST remember to delete the FsContext on error.
      */
diff --git a/src/sys/driver.h b/src/sys/driver.h
index 1acf6109..bd5d8022 100644
--- a/src/sys/driver.h
+++ b/src/sys/driver.h
@@ -334,7 +334,6 @@ typedef struct
 {
     FSRTL_ADVANCED_FCB_HEADER Header;
     FSP_FILE_CONTEXT_NONPAGED *NonPaged;
-    BOOLEAN HasTrailingBackslash;
     UNICODE_STRING FileName;
     WCHAR FileNameBuf[];
 } FSP_FILE_CONTEXT;