38 lines
1.4 KiB
Diff
38 lines
1.4 KiB
Diff
From 2fc07f4ce31a2cc9973cfb1c20897c6a4babd8b8 Mon Sep 17 00:00:00 2001
|
|
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Fri, 15 May 2020 16:45:28 +0800
|
|
Subject: [PATCH] slirp: tftp: restrict relative path access
|
|
|
|
tftp restricts relative or directory path access on Linux systems.
|
|
Apply same restrictions on Windows systems too. It helps to avoid
|
|
directory traversal issue.
|
|
|
|
Fixes: https://bugs.launchpad.net/qemu/+bug/1812451Reported-by: default avatarPeter Maydell <peter.maydell@linaro.org>
|
|
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
|
|
Reviewed-by: Samuel Thibault's avatarSamuel Thibault <samuel.thibault@ens-lyon.org>
|
|
Message-Id: <20200113121431.156708-1-ppandit@redhat.com>
|
|
|
|
diff --git a/slirp/src/tftp.c b/slirp/src/tftp.c
|
|
index 093c2e06..2b4176cc 100644
|
|
--- a/slirp/src/tftp.c
|
|
+++ b/slirp/src/tftp.c
|
|
@@ -344,8 +344,13 @@ static void tftp_handle_rrq(Slirp *slirp, struct sockaddr_storage *srcsas,
|
|
k += 6; /* skipping octet */
|
|
|
|
/* do sanity checks on the filename */
|
|
- if (!strncmp(req_fname, "../", 3) ||
|
|
- req_fname[strlen(req_fname) - 1] == '/' || strstr(req_fname, "/../")) {
|
|
+ if (
|
|
+#ifdef G_OS_WIN32
|
|
+ strstr(req_fname, "..\\") ||
|
|
+ req_fname[strlen(req_fname) - 1] == '\\' ||
|
|
+#endif
|
|
+ strstr(req_fname, "../") ||
|
|
+ req_fname[strlen(req_fname) -1] == '/') {
|
|
tftp_send_error(spt, 2, "Access violation", tp);
|
|
return;
|
|
}
|
|
--
|
|
2.23.0
|
|
|