From b96c4240ae6bddb4c929115cbd7d31698d72a5f7 Mon Sep 17 00:00:00 2001 From: David Oberhollenzer Date: Sun, 7 Jun 2020 16:24:47 +0200 Subject: Replace assert with propper error handling in rdsquashfs describe If a SquashFS archive contains file names with '..', '/' or similar nonsense in them, the unpacking code already refuses to process them, but the 'describe' code path simply triggers an assert that might not be there if the binary was compiled with NDEBUG defined. This commit replaces the assert with propper error handling that also reports on why things are failing and adds an additional check in the describe_tree function that tests if the file name is sane. Reported-by: Zachary Dremann Signed-off-by: David Oberhollenzer --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) (limited to 'CHANGELOG.md') diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c9777b..c1d944e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -29,6 +29,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Actually set the ZSTD compression level to something greater than 0 - Only add Selinux compile flags if WITH_SELINUX is set. Fixes Mingw cross build on Fedora. +- Make `rdsquashfs` describe mode terminate with an error message if an illegal + filename is encountered. ## [0.9.1] - 2020-05-03 ### Added -- cgit v1.2.3