Attachment 25750 Details for Bug 62184

[patch] patch

unarj-2.65-tree.diff (text/plain), 1.34 KB, created by Marian Jancar on 2004-11-04 02:20:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marian Jancar

Created: 2004-11-04 02:20:44 UTC

Size: 1.34 KB

patch

obsolete

>--- unarj.c
>+++ unarj.c
>@@ -84,6 +84,8 @@
> #include <console.h>
> #endif
> 
>+#include <alloca.h>
>+
> /* Global variables */
> 
> UCRC   crc;
>@@ -584,6 +586,35 @@
>     return -1;          /* could not find a valid header */
> }
> 
>+/* avoid extracting outside of current directory */
>+static void sanitize_filename(char *sane, char *insane, size_t len)
>+{
>+	char *tmp, *next, *cur, *_sane = sane;
>+	
>+	tmp = alloca(len);
>+	cur = NULL;
>+
>+	strncopy(tmp, insane, len);
>+	tmp[len] = '\0';
>+	
>+	for(next = strtok(tmp, "/"); next; next = strtok(NULL, "/")) {
>+		if(!strcmp(".", next) || !strcmp("..", next))
>+			continue;
>+		if(cur) {
>+			strcpy(sane, cur);
>+			sane += strlen(cur);
>+			strcpy(sane, "/");
>+			sane++;
>+		}
>+		cur = next;
>+	}
>+	
>+	if(cur)
>+		strcpy(sane, cur);
>+	
>+	entry_pos = sane - _sane;
>+}
>+
> static int
> read_header(first, fd, name)
> int  first;
>@@ -634,7 +665,15 @@
>         error(M_HEADRCRC, "");
> 
>     hdr_filename = (char *)&header[first_hdr_size];
>-    strncopy(filename, hdr_filename, sizeof(filename));
>+    switch(file_type) {
>+    case 0: /* binary */
>+    case 1: /* text */
>+    case 3: /* directory */
>+	sanitize_filename(filename, hdr_filename, sizeof(filename));
>+	break;
>+    default:
>+	strncopy(filename, hdr_filename, sizeof(filename));
>+    }
>     if (host_os != OS)
>         strparity((uchar *)filename);
>     if ((arj_flags & PATHSYM_FLAG) != 0)

Actions: View | Diff

Attachments on bug 62184: 24933 | 25750 | 25912 | 25913 | 25914 | 25916 | 26306 | 26307