From a773cf48d827f028a933c9ef352d89fbf21668c7 Mon Sep 17 00:00:00 2001
From: Harshavardhana <harsha@minio.io>
Date: Fri, 18 Dec 2020 08:51:09 -0800
Subject: [PATCH] fix: overlapping object and prefix rejected (#11130)

fixes #11129
---
 cmd/xl-storage.go | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/cmd/xl-storage.go b/cmd/xl-storage.go
index dad574139..0610fb573 100644
--- a/cmd/xl-storage.go
+++ b/cmd/xl-storage.go
@@ -39,6 +39,7 @@ import (
 	"time"
 
 	"github.com/dustin/go-humanize"
+	"github.com/google/uuid"
 	jsoniter "github.com/json-iterator/go"
 	"github.com/klauspost/readahead"
 	"github.com/minio/minio/cmd/config"
@@ -1989,6 +1990,7 @@ func (s *xlStorage) RenameData(ctx context.Context, srcVolume, srcPath, dataDir,
 		}
 		return err
 	}
+
 	_, err = os.Stat(dstVolumeDir)
 	if err != nil {
 		if osIsNotExist(err) {
@@ -2045,6 +2047,38 @@ func (s *xlStorage) RenameData(ctx context.Context, srcVolume, srcPath, dataDir,
 				return osErrToFileErr(err)
 			}
 		}
+		if err == errFileNotFound {
+			// Verification to ensure that we
+			// don't have objects already created
+			// at this location, verify that resultant
+			// directories don't have any unexpected
+			// directories that we do not understand
+			// or expect. If its already there we should
+			// make sure to reject further renames
+			// for such objects.
+			//
+			// This elaborate check is necessary to avoid
+			// scenarios such as these.
+			//
+			// bucket1/name1/obj1/xl.meta
+			// bucket1/name1/xl.meta --> this should never
+			// be allowed.
+			{
+				entries, err := readDirN(path.Dir(dstFilePath), 1)
+				if err != nil && err != errFileNotFound {
+					return err
+				}
+				if len(entries) > 0 {
+					entry := path.Clean(entries[0])
+					if entry != legacyDataDir {
+						_, uerr := uuid.Parse(entry)
+						if uerr != nil {
+							return errFileParentIsFile
+						}
+					}
+				}
+			}
+		}
 	}
 
 	var xlMeta xlMetaV2