Do an explicit "is filename sane" check

Until now, filenames containing '/' or being equal to '..' or '.' where
not handled explicitly, because they are canonicalized later, which
will then fail.

This commit adds an explicit check to make those fail immediately with
a clear, specific error message.

Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>

1 files changed, 6 insertions, 0 deletions

diff --git a/unpack/fill_files.c b/unpack/fill_files.c
index 481c398..e6444b2 100644
--- a/unpack/fill_files.c
+++ b/unpack/fill_files.c
@@ -114,6 +114,12 @@ static void clear_file_list(void)
 
 static int gen_file_list_dfs(const sqfs_tree_node_t *n)
 {
+	if (!is_filename_sane((const char *)n->name)) {
+		fprintf(stderr, "Found an entry named '%s', skipping.\n",
+			n->name);
+		return 0;
+	}
+
 	if (S_ISREG(n->inode->base.mode))
 		return add_file(n);