miguel.horta/openttd-android
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

(svn r26543) [1.4] -Backport from trunk:

Browse Source 
- Fix: Buffer overruns in handling of symbolic links inside tars (r26514)
- Fix: Incorrect usage of strecpy (r26505, r26485)
- Fix: Reading console input on dedicated server relied on unspecified behaviour (r26496)
This commit is contained in:
frosch
2014-04-29 18:35:01 +00:00
committed by Sergii Pylypenko
parent fd7f0c28f3
commit e69b50c898
4 changed files with 35 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/fileio.cpp
+29 -20
View File
@@ -853,29 +853,38 @@ bool TarScanner::AddFile(const char *filename, size_t basepath_length, const cha
char *pos = link;
while (*pos != '\0') {
char *next = strchr(link, PATHSEPCHAR);
if (next == NULL) next = pos + strlen(pos);
char *next = strchr(pos, PATHSEPCHAR);
if (next == NULL) {
next = pos + strlen(pos);
} else {
/* Terminate the substring up to the path separator character. */
*next++= '\0';
}
/* Skip '.' (current dir) */
if (next != pos + 1 || pos[0] != '.') {
if (next == pos + 2 && pos[0] == '.' && pos[1] == '.') {
/* level up */
if (dest[0] == '\0') {
DEBUG(misc, 1, "Ignoring link pointing outside of data directory: %s -> %s", name, link);
break;
}
/* Truncate 'dest' after last PATHSEPCHAR.
* This assumes that the truncated part is a real directory and not a link. */
destpos = strrchr(dest, PATHSEPCHAR);
if (destpos == NULL) destpos = dest;
} else {
/* Append at end of 'dest' */
if (destpos != dest) *(destpos++) = PATHSEPCHAR;
strncpy(destpos, pos, next - pos); // Safe as we do '\0'-termination ourselves
destpos += next - pos;
if (strcmp(pos, ".") == 0) {
/* Skip '.' (current dir) */
} else if (strcmp(pos, "..") == 0) {
/* level up */
if (dest[0] == '\0') {
DEBUG(misc, 1, "Ignoring link pointing outside of data directory: %s -> %s", name, link);
break;
}
/* Truncate 'dest' after last PATHSEPCHAR.
* This assumes that the truncated part is a real directory and not a link. */
destpos = strrchr(dest, PATHSEPCHAR);
if (destpos == NULL) destpos = dest;
*destpos = '\0';
} else {
/* Append at end of 'dest' */
if (destpos != dest) destpos = strecpy(destpos, PATHSEP, lastof(dest));
destpos = strecpy(destpos, pos, lastof(dest));
}
if (destpos >= lastof(dest)) {
DEBUG(misc, 0, "The length of a link in tar-file '%s' is too large (malformed?)", filename);
fclose(f);
return false;
}
pos = next;