diff options
| author | Jan Kiszka <jan.kiszka@web.de> | 2009-06-29 08:47:30 +0200 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2009-06-29 14:18:08 -0500 |
| commit | 74efd61a75f1a400aa480ad08231ba31ccdec895 (patch) | |
| tree | 48c416491195feab0a8126937043f770cb39ce0c /slirp/tftp.c | |
| parent | 229609dd45ee572fb343366a5bf440afb25cf614 (diff) | |
| download | qemu-74efd61a75f1a400aa480ad08231ba31ccdec895.tar.gz qemu-74efd61a75f1a400aa480ad08231ba31ccdec895.tar.bz2 qemu-74efd61a75f1a400aa480ad08231ba31ccdec895.zip | |
slirp: tftp: Relax filename format check
[ Applies on top of my recently posted slirp series. ]
Allow tftp requests with filenames that do not start with a slash.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'slirp/tftp.c')
| -rw-r--r-- | slirp/tftp.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/slirp/tftp.c b/slirp/tftp.c index 3b8643b8d8..082f5d0409 100644 --- a/slirp/tftp.c +++ b/slirp/tftp.c @@ -284,11 +284,12 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen) /* prepend tftp_prefix */ prefix_len = strlen(slirp->tftp_prefix); - spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 1); + spt->filename = qemu_malloc(prefix_len + TFTP_FILENAME_MAX + 2); memcpy(spt->filename, slirp->tftp_prefix, prefix_len); + spt->filename[prefix_len] = '/'; /* get name */ - req_fname = spt->filename + prefix_len; + req_fname = spt->filename + prefix_len + 1; while (1) { if (k >= TFTP_FILENAME_MAX || k >= pktlen) { @@ -315,7 +316,8 @@ static void tftp_handle_rrq(Slirp *slirp, struct tftp_t *tp, int pktlen) k += 6; /* skipping octet */ /* do sanity checks on the filename */ - if (req_fname[0] != '/' || req_fname[strlen(req_fname) - 1] == '/' || + if (!strncmp(req_fname, "../", 3) || + req_fname[strlen(req_fname) - 1] == '/' || strstr(req_fname, "/../")) { tftp_send_error(spt, 2, "Access violation", tp); return; |