mirror
/
OpenTTD
mirror of https://github.com/OpenTTD/OpenTTD
1
0
Fork 0
Code Issues

(svn r26514) -Fix: rewrite link-in-tar handling so it doesn't use strncpy and it doesn't overrun its buffers anymore

release/1.5
rubidium 2014-04-25 21:29:54 +00:00
parent 08eeec15be
commit 5ef2042819
2 changed files with 30 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
src/fileio.cpp
View File

@ -851,29 +851,38 @@ bool TarScanner::AddFile(const char *filename, size_t basepath_length, const cha
char *pos = link; char *pos = link;
while (*pos != '\0') { while (*pos != '\0') {
char *next = strchr(link, PATHSEPCHAR); char *next = strchr(pos, PATHSEPCHAR);
if (next == NULL) next = pos + strlen(pos); if (next == NULL) {
next = pos + strlen(pos);
} else {
/* Terminate the substring up to the path separator character. */
*next++= '\0';
}
/* Skip '.' (current dir) */ if (strcmp(pos, ".") == 0) {
if (next != pos + 1 || pos[0] != '.') { /* Skip '.' (current dir) */
if (next == pos + 2 && pos[0] == '.' && pos[1] == '.') { } else if (strcmp(pos, "..") == 0) {
/* level up */ /* level up */
if (dest[0] == '\0') { if (dest[0] == '\0') {
DEBUG(misc, 1, "Ignoring link pointing outside of data directory: %s -> %s", name, link); DEBUG(misc, 1, "Ignoring link pointing outside of data directory: %s -> %s", name, link);
break; break;
}
/* Truncate 'dest' after last PATHSEPCHAR.
* This assumes that the truncated part is a real directory and not a link. */
destpos = strrchr(dest, PATHSEPCHAR);
if (destpos == NULL) destpos = dest;
} else {
/* Append at end of 'dest' */
if (destpos != dest) *(destpos++) = PATHSEPCHAR;
strncpy(destpos, pos, next - pos); // Safe as we do '\0'-termination ourselves
destpos += next - pos;
} }
/* Truncate 'dest' after last PATHSEPCHAR.
* This assumes that the truncated part is a real directory and not a link. */
destpos = strrchr(dest, PATHSEPCHAR);
if (destpos == NULL) destpos = dest;
*destpos = '\0'; *destpos = '\0';
} else {
/* Append at end of 'dest' */
if (destpos != dest) destpos = strecpy(destpos, PATHSEP, lastof(dest));
destpos = strecpy(destpos, pos, lastof(dest));
}
if (destpos >= lastof(dest)) {
DEBUG(misc, 0, "The length of a link in tar-file '%s' is too large (malformed?)", filename);
fclose(f);
return false;
} }
pos = next; pos = next;

2
src/safeguards.h
View File

@ -36,7 +36,7 @@
/* Use strecpy instead. */ /* Use strecpy instead. */
#define strcpy SAFEGUARD_DO_NOT_USE_THIS_METHOD #define strcpy SAFEGUARD_DO_NOT_USE_THIS_METHOD
//#define strncpy SAFEGUARD_DO_NOT_USE_THIS_METHOD #define strncpy SAFEGUARD_DO_NOT_USE_THIS_METHOD
/* Use strecat instead. */ /* Use strecat instead. */
#define strcat SAFEGUARD_DO_NOT_USE_THIS_METHOD #define strcat SAFEGUARD_DO_NOT_USE_THIS_METHOD