[Slirp] [PATCH v3] slirp: tftp: restrict relative path access

[Samuel Thibault]

Hello,

P J P, le lun. 13 janv. 2020 17:44:31 +0530, a ecrit:
> From: Prasad J Pandit <pjp at fedoraproject.org>
> 
> tftp restricts relative or directory path access on Linux systems.
> Apply same restrictions on Windows systems too. It helps to avoid
> directory traversal issue.

Applied, thanks!

> Fixes: https://bugs.launchpad.net/qemu/+bug/1812451
> Reported-by: Peter Maydell <peter.maydell at linaro.org>
> Signed-off-by: Prasad J Pandit <pjp at fedoraproject.org>
> ---
>  src/tftp.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> Update v3: use #ifdef mid-if-expression
>   -> https://lists.freedesktop.org/archives/slirp/2020-January/000047.html
> 
> diff --git a/src/tftp.c b/src/tftp.c
> index 093c2e0..ebb80b5 100644
> --- a/src/tftp.c
> +++ b/src/tftp.c
> @@ -344,8 +344,13 @@ static void tftp_handle_rrq(Slirp *slirp, struct sockaddr_storage *srcsas,
>      k += 6; /* skipping octet */
>  
>      /* do sanity checks on the filename */
> -    if (!strncmp(req_fname, "../", 3) ||
> -        req_fname[strlen(req_fname) - 1] == '/' || strstr(req_fname, "/../")) {
> +    if (
> +#ifdef G_OS_WIN32
> +        strstr(req_fname, "..\\")
> +        || req_fname[strlen(req_fname) - 1] == '\\' ||
> +#endif
> +        strstr(req_fname, "../")
> +        || req_fname[strlen(req_fname) - 1] == '/') {
>          tftp_send_error(spt, 2, "Access violation", tp);
>          return;
>      }
> -- 
> 2.24.1
> 

-- 
Samuel
<c> tiens, je suis déçu
<c> quand on clique sur le bouton random de http://xkcd.com/221/ on ne tombe pas (toujours) sur http://xkcd.com/4/
<c> bon, j'envoie un bug-report à l'auteur