aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMax Kellermann <max@duempel.org>2008-10-31 16:48:58 +0100
committerMax Kellermann <max@duempel.org>2008-10-31 16:48:58 +0100
commitf291876772d1283433924518f87e639e17901a17 (patch)
treee9ce02c3dde705d62e377f0e590ca0d2fa3b1cb2
parenta5f8d4386c3d7b59bab15499d5d70f8d2713626f (diff)
downloadmpd-f291876772d1283433924518f87e639e17901a17.tar.gz
mpd-f291876772d1283433924518f87e639e17901a17.tar.xz
mpd-f291876772d1283433924518f87e639e17901a17.zip
mapper: check for "." and ".."
Make map_directory_child_fs() refuse the names "." and "..". This is currently the interface where an attacker may inject a manipulated path (through the "update" command).
-rw-r--r--src/mapper.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/src/mapper.c b/src/mapper.c
index a21b42d92..4510241dc 100644
--- a/src/mapper.c
+++ b/src/mapper.c
@@ -100,6 +100,11 @@ map_directory_child_fs(const struct directory *directory, const char *name,
char buffer2[MPD_PATH_MAX];
const char *parent_fs;
+ /* check for invalid or unauthorized base names */
+ if (*name == 0 || strchr(name, '/') != NULL ||
+ strcmp(name, ".") == 0 || strcmp(name, "..") == 0)
+ return NULL;
+
parent_fs = map_directory_fs(directory, buffer2);
if (parent_fs == NULL)
return NULL;