squashfs-tools-ng.git/bin/rdsquashfs, branch v1.0.6

Fix symlink path traversal in rdsqaushfs

2021-08-14T13:20:05+00:00

If rdsquashfs unpacks a directory tree that contains a symlink, followed by something else with the exact same name, it will follow the symlink and can be tricked into writing to an arbitrary filesystem location controlled by the SquashFS image. Because there might actually be a reasonable use case, where an image is unpacked into an directory existing directory tree, with symlinks that should be followed, this is solved as follows: - Before unpacking, recursively sort the directory by filename. - FAIL if (after sorting) two consequtive entries at the same hierarchy level have the same name. This solution is more generic and prevents the unpacker from accessing the same thing twice in generall, thus also excluding the symlink issue. Hardlinks are already unfolded into duplicate tree nodes by the tree reader (with loop detection) so that should not prompt further issues. Signed-off-by: David Oberhollenzer

Fix format string type/signedness mismatch issues

2021-06-25T15:49:36+00:00

Signed-off-by: David Oberhollenzer

Add default cases for every switch block

2021-06-25T15:49:11+00:00

Signed-off-by: David Oberhollenzer

Fix: libsquashfs: add sqfs_free() function

2021-06-07T12:35:40+00:00

On systems like Windows, the dynamic library and applications can easily end up being linked against different runtime libraries, so applications cannot be expected to be able to free() any malloc'd pointer that the library returns. This commit adds an sqfs_free function so the application can pass pointers back to the library to call the correct free() implementation. Signed-off-by: David Oberhollenzer

Fix: rdsquashfs: describe: don't escape the prefixed file input path

2020-09-29T16:21:21+00:00

If rdsquashfs describes a filesystem, is configured to use a prefix-path and a file contains a space, the resulting input path has the prefix printed as is and the rest of the string in quotation marks. gensquashfs simply takes the entire rest of the line as is as its input path and no longer finds the file. Fix this by omitting the escapes and quotation marks for the input path. Signed-off-by: David Oberhollenzer

Fix rdsquashfs unpack under Windows if a directory exists

2020-08-26T16:23:35+00:00

Behave the same way as the POSIX port and do not treat that as an error. Signed-off-by: David Oberhollenzer

Add a "--stat" option to rdsquashfs

2020-08-11T22:25:34+00:00

This commit adds a --stat option to rdsquashfs that dumps a lot of information about and inode that tunred out to be usefull in debugging. Signed-off-by: David Oberhollenzer

Add flags to functions that might logically be expanded in the future

2020-06-11T13:36:08+00:00

Signed-off-by: David Oberhollenzer

Replace assert with propper error handling in rdsquashfs describe

2020-06-07T15:23:51+00:00

If a SquashFS archive contains file names with '..', '/' or similar nonsense in them, the unpacking code already refuses to process them, but the 'describe' code path simply triggers an assert that might not be there if the binary was compiled with NDEBUG defined. This commit replaces the assert with propper error handling that also reports on why things are failing and adds an additional check in the describe_tree function that tests if the file name is sane. Reported-by: Zachary Dremann Signed-off-by: David Oberhollenzer

Cleanup: Reorganize structure of Automake files

2020-05-30T15:49:40+00:00

- Split up the huge file in bin/ into one small file per sub directory - Remove the stub in doc/ Signed-off-by: David Oberhollenzer