david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

slirp: tftp: Relax filename format check

Browse Source 
[ Applies on top of my recently posted slirp series. ]

Allow tftp requests with filenames that do not start with a slash.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Jan Kiszka 2009-06-29 08:47:30 +02:00 committed by Anthony Liguori
parent 229609dd45
commit 74efd61a75
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
slirp/tftp.c
View File

@ -284,11 +284,12 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
/* prepend tftp_prefix */ /* prepend tftp_prefix */
prefix_len = strlen(slirp->tftp_prefix); prefix_len = strlen(slirp->tftp_prefix);
spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 1); spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 2);
memcpy(spt->filename, slirp->tftp_prefix, prefix_len); memcpy(spt->filename, slirp->tftp_prefix, prefix_len);
spt->filename[prefix_len] = '/';
/* get name */ /* get name */
req_fname = spt->filename + prefix_len; req_fname = spt->filename + prefix_len + 1;
while (1) { while (1) {
if (k >= TFTP_FILENAME_MAX || k >= pktlen) { if (k >= TFTP_FILENAME_MAX || k >= pktlen) {
@ -315,7 +316,8 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen)
k += 6; /* skipping octet */ k += 6; /* skipping octet */
/* do sanity checks on the filename */ /* do sanity checks on the filename */
if (req_fname[0] != '/' || req_fname[strlen(req_fname) - 1] == '/' || if (!strncmp(req_fname, "../", 3) ||
req_fname[strlen(req_fname) - 1] == '/' ||
strstr(req_fname, "/../")) { strstr(req_fname, "/../")) {
tftp_send_error(spt, 2, "Access violation", tp); tftp_send_error(spt, 2, "Access violation", tp);
return; return;