Explorar o código

Catch access to paths that are just "." or ".." without any path separator.
(transplanted from b6d25a1927c2274cf31166a74b87b24e2752e0e8)

Ryan C. Gordon %!s(int64=8) %!d(string=hai) anos
pai
achega
179bd1d40a
Modificáronse 1 ficheiros con 4 adicións e 0 borrados
  1. 4 0
      src/physfs.c

+ 4 - 0
src/physfs.c

@@ -939,6 +939,10 @@ static int sanitizePlatformIndependentPath(const char *src, char *dst)
     while (*src == '/')  /* skip initial '/' chars... */
         src++;
 
+    /* Make sure the entire string isn't "." or ".." */
+    if ((strcmp(src, ".") == 0) || (strcmp(src, "..") == 0))
+        BAIL(PHYSFS_ERR_BAD_FILENAME, 0);
+
     prev = dst;
     do
     {