diff options
Diffstat (limited to 'audio')
-rw-r--r-- | audio/yamt/Makefile | 2 | ||||
-rw-r--r-- | audio/yamt/files/patch-yamt-directory-traversal | 123 |
2 files changed, 124 insertions, 1 deletions
diff --git a/audio/yamt/Makefile b/audio/yamt/Makefile index ed97386..51d9588 100644 --- a/audio/yamt/Makefile +++ b/audio/yamt/Makefile @@ -7,7 +7,7 @@ PORTNAME= yamt PORTVERSION= 0.5 -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= audio gnome MASTER_SITES= ${MASTER_SITE_SOURCEFORGE} \ ftp://ftp.gpad.ac.ru/pub/FreeBSD/distfiles/ diff --git a/audio/yamt/files/patch-yamt-directory-traversal b/audio/yamt/files/patch-yamt-directory-traversal new file mode 100644 index 0000000..99ec831 --- /dev/null +++ b/audio/yamt/files/patch-yamt-directory-traversal @@ -0,0 +1,123 @@ +--- src/id3tag.c ++++ src/id3tag.c +@@ -389,12 +389,20 @@ + return(1); + } + ++static void id3tag_sanitize (char *string) ++{ ++ while ((string = strchr (string, '/'))) ++ { ++ *string = '_'; ++ } ++} ++ + /* This function renames a file based on its tag in the given format */ + int id3tag_rename( char *filename, char *format ) + { + struct id3tag tag; + struct stat stbuf; +- char target_filename[80]=""; ++ char target_filename[PATH_MAX]=""; + char buffer[10]=""; + char *tmp; + int i; +@@ -425,36 +433,42 @@ + { + case 't': + strcat( target_filename, tag.title); ++ id3tag_sanitize (target_filename+i2); + i2=i2+strlen(tag.title); + i++; + break; + + case 'a': + strcat( target_filename, tag.artist); ++ id3tag_sanitize (target_filename+i2); + i2=i2+strlen(tag.artist); + i++; + break; + + case 'b': + strcat( target_filename, tag.album); ++ id3tag_sanitize (target_filename+i2); + i2=i2+strlen(tag.album); + i++; + break; + + case 'c': + strcat( target_filename, tag.comment); ++ id3tag_sanitize (target_filename+i2); + i2=i2+strlen(tag.comment); + i++; + break; + + case 'y': + strcat( target_filename, tag.year); ++ id3tag_sanitize (target_filename+i2); + i2=i2+strlen(tag.year); + i++; + break; + + case 'g': + strcat( target_filename, id3tag_get_genre(tag.genre)); ++ id3tag_sanitize (target_filename+i2); + i2=i2+strlen(id3tag_get_genre(tag.genre)); + i++; + break; +@@ -521,9 +535,9 @@ + int id3tag_sort( char *filename, char *rootdir, char *format_level1, char *format_level2 ) + { + struct id3tag tag; +- char *dir_level1=NULL; +- char *dir_level2=NULL; +- char target_filename[80]; ++ char *dir_level1=NULL, *dir_level1_sanitized; ++ char *dir_level2=NULL, *dir_level2_sanitized; ++ char source_filename[PATH_MAX], target_filename[PATH_MAX]; + char dir_cur[80]; + + +@@ -554,8 +568,10 @@ + chdir(rootdir); + if( dir_level1[0] == '\0' ) + dir_level1 = "Unknown"; +- yamtlog("%s %s", "New directory: ", dir_level1); +- mkdir( dir_level1, S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH ); ++ dir_level1_sanitized = strdup (dir_level1); ++ id3tag_sanitize (dir_level1_sanitized); ++ yamtlog("%s %s", "New directory: ", dir_level1_sanitized); ++ mkdir( dir_level1_sanitized, S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH ); + + /* Level 2 */ + if( strcmp( format_level2, "Album") == 0 ) +@@ -573,18 +589,24 @@ + + if( dir_level2[0] == '\0' ) + dir_level2 = "Unknown"; +- yamtlog("%s %s", "New directory: ", dir_level2); ++ dir_level2_sanitized = strdup (dir_level2); ++ id3tag_sanitize (dir_level2_sanitized); ++ yamtlog("%s %s", "New directory: ", dir_level2_sanitized); + + /* Go into the previously created directory */ +- chdir( dir_level1 ); +- mkdir( dir_level2, S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH ); ++ chdir( dir_level1_sanitized ); ++ mkdir( dir_level2_sanitized, S_IRUSR|S_IWUSR|S_IXUSR|S_IRGRP|S_IXGRP|S_IROTH ); + /* Move the file into the new (?) directory */ + +- sprintf( target_filename, "mv \"%s/%s\" \"%s%s/%s/%s\"", dir_cur, filename, rootdir, dir_level1, dir_level2, filename ); ++ snprintf( source_filename, PATH_MAX, "%s/%s", dir_cur, filename ); ++ snprintf( target_filename, PATH_MAX, "%s%s/%s/%s", rootdir, dir_level1_sanitized, dir_level2_sanitized, filename ); ++ ++ free (dir_level1_sanitized); ++ free (dir_level2_sanitized); + + yamtlog("%s %s", "Sorted ", filename ); + +- system( target_filename ); ++ rename( source_filename, target_filename ); + + /* if( (rename( filename, target_filename )) ) */ + /* { */ |