--- ./disk.c.orig	2008-02-15 18:13:25.000000000 -0600
+++ ./disk.c	2011-04-20 20:27:55.978000772 -0500
@@ -356,6 +356,19 @@
 		filename[strlen(filename) - 1] = 0;
 	sprintf(path, "%s%s", g_rdpdr_device[device_id].local_path, filename);
 
+        /* Protect against mailicous servers:
+           somelongpath/..     not allowed
+           somelongpath/../b   not allowed
+           somelongpath/..b    in principle ok, but currently not allowed
+           somelongpath/b..    ok
+           somelongpath/b..b   ok
+           somelongpath/b../c  ok
+         */
+        if (strstr(path, "/.."))
+        {
+                return RD_STATUS_ACCESS_DENIED;
+        }
+
 	switch (create_disposition)
 	{
 		case CREATE_ALWAYS: