summaryrefslogtreecommitdiff
path: root/lib/fstream/uncompress/xz.c
diff options
context:
space:
mode:
authorDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2021-08-12 15:01:59 +0200
committerDavid Oberhollenzer <david.oberhollenzer@sigma-star.at>2021-08-12 18:24:38 +0200
commitad109e2b119cb3ed27c7d964be9625d415447eb1 (patch)
tree52b82b9424e4da5d037856ac3ea20743a89d2d04 /lib/fstream/uncompress/xz.c
parent4188e94626aba41695eac49852c9e21203727e8c (diff)
Fix symlink path traversal in rdsqaushfs
If rdsquashfs unpacks a directory tree that contains a symlink, followed by something else with the exact same name, it will follow the symlink and can be tricked into writing to an arbitrary filesystem location controlled by the SquashFS image. Because there might actually be a reasonable use case, where an image is unpacked into an directory existing directory tree, with symlinks that should be followed, this is solved as follows: - Before unpacking, recursively sort the directory by filename. - FAIL if (after sorting) two consequtive entries at the same hierarchy level have the same name. This solution is more generic and prevents the unpacker from accessing the same thing twice in generall, thus also excluding the symlink issue. Hardlinks are already unfolded into duplicate tree nodes by the tree reader (with loop detection) so that should not prompt further issues. Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
Diffstat (limited to 'lib/fstream/uncompress/xz.c')
0 files changed, 0 insertions, 0 deletions