From e21bf0b60c1b9d67fe7553105b6440c3fce7c0bb Mon Sep 17 00:00:00 2001 From: David Oberhollenzer Date: Mon, 7 Oct 2019 15:54:41 +0200 Subject: Do an explicit "is filename sane" check Until now, filenames containing '/' or being equal to '..' or '.' where not handled explicitly, because they are canonicalized later, which will then fail. This commit adds an explicit check to make those fail immediately with a clear, specific error message. Signed-off-by: David Oberhollenzer --- unpack/fill_files.c | 6 ++++++ unpack/restore_fstree.c | 9 +++++++++ 2 files changed, 15 insertions(+) (limited to 'unpack') diff --git a/unpack/fill_files.c b/unpack/fill_files.c index 481c398..e6444b2 100644 --- a/unpack/fill_files.c +++ b/unpack/fill_files.c @@ -114,6 +114,12 @@ static void clear_file_list(void) static int gen_file_list_dfs(const sqfs_tree_node_t *n) { + if (!is_filename_sane((const char *)n->name)) { + fprintf(stderr, "Found an entry named '%s', skipping.\n", + n->name); + return 0; + } + if (S_ISREG(n->inode->base.mode)) return add_file(n); diff --git a/unpack/restore_fstree.c b/unpack/restore_fstree.c index 1dadce4..6995d47 100644 --- a/unpack/restore_fstree.c +++ b/unpack/restore_fstree.c @@ -12,6 +12,12 @@ static int create_node(const sqfs_tree_node_t *n, int flags) int fd, ret; char *name; + if (!is_filename_sane((const char *)n->name)) { + fprintf(stderr, "Found an entry named '%s', skipping.\n", + n->name); + return 0; + } + if (!(flags & UNPACK_QUIET)) { name = sqfs_tree_node_get_path(n); if (name != NULL) { @@ -154,6 +160,9 @@ static int set_attribs(sqfs_xattr_reader_t *xattr, { const sqfs_tree_node_t *c; + if (!is_filename_sane((const char *)n->name)) + return 0; + if (S_ISDIR(n->inode->base.mode)) { if (pushd((const char *)n->name)) return -1; -- cgit v1.2.3