From 030f982dd69dac94b908d1e725850626a5185985 Mon Sep 17 00:00:00 2001 From: phk Date: Sat, 25 Feb 1995 05:02:18 +0000 Subject: Just a precaution: ctm will not accept '..' in paths anymore. I'm never going to generate one, so this is a guard against hackers mostly. Reviewed by: phk Submitted by: Stephen McKay Obtained from: --- usr.sbin/ctm/ctm/ctm_pass1.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'usr.sbin/ctm') diff --git a/usr.sbin/ctm/ctm/ctm_pass1.c b/usr.sbin/ctm/ctm/ctm_pass1.c index 8d69b18..7ef3cb9 100644 --- a/usr.sbin/ctm/ctm/ctm_pass1.c +++ b/usr.sbin/ctm/ctm/ctm_pass1.c @@ -6,7 +6,7 @@ * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp * ---------------------------------------------------------------------------- * - * $Id: ctm_pass1.c,v 1.5 1994/11/26 08:57:40 phk Exp $ + * $Id: ctm_pass1.c,v 1.6 1995/02/04 19:20:47 phk Exp $ * */ @@ -97,6 +97,16 @@ Pass1(FILE *fd) Fatal("Absolute paths are illegal."); return Exit_Mess; } + for (;;) { + if (p[0] == '.' && p[1] == '.') + if (p[2] == '/' || p[2] == '\0') { + Fatal("Paths containing '..' are illegal."); + return Exit_Mess; + } + if ((p = strchr(p, '/')) == NULL) + break; + p++; + } break; case CTM_F_Uid: GETFIELD(p,sep); -- cgit v1.1