Blame SOURCES/gcc34-CVE-2006-3619.patch
|
 |
6fdc0f |
2006-07-17 Richard Guenther <rguenther@suse.de>
|
|
|
6fdc0f |
|
|
|
6fdc0f |
* jartool.c (extract_jar): Do not allow directory traversal
|
|
|
6fdc0f |
to parents of the extraction root.
|
|
|
6fdc0f |
|
|
|
6fdc0f |
--- fastjar/jartool.c.jj 2006-07-11 10:53:39.000000000 +0200
|
|
|
6fdc0f |
+++ fastjar/jartool.c 2006-07-18 13:49:39.000000000 +0200
|
|
|
6fdc0f |
@@ -1736,6 +1736,7 @@ int extract_jar(int fd, char **files, in
|
|
|
6fdc0f |
const ub1 *start = filename;
|
|
|
6fdc0f |
char *tmp_buff;
|
|
|
6fdc0f |
struct stat sbuf;
|
|
|
6fdc0f |
+ int depth = 0;
|
|
|
6fdc0f |
|
|
|
6fdc0f |
tmp_buff = malloc(sizeof(char) * strlen((const char *)filename));
|
|
|
6fdc0f |
|
|
|
6fdc0f |
@@ -1756,7 +1757,14 @@ int extract_jar(int fd, char **files, in
|
|
|
6fdc0f |
#ifdef DEBUG
|
|
|
6fdc0f |
printf("checking the existance of %s\n", tmp_buff);
|
|
|
6fdc0f |
#endif
|
|
|
6fdc0f |
-
|
|
|
6fdc0f |
+ if(strcmp(tmp_buff, "..") == 0){
|
|
|
6fdc0f |
+ --depth;
|
|
|
6fdc0f |
+ if (depth < 0){
|
|
|
6fdc0f |
+ fprintf(stderr, "Traversal to parent directories during unpacking!\n");
|
|
|
6fdc0f |
+ exit(1);
|
|
|
6fdc0f |
+ }
|
|
|
6fdc0f |
+ } else if (strcmp(tmp_buff, ".") != 0)
|
|
|
6fdc0f |
+ ++depth;
|
|
|
6fdc0f |
if(stat(tmp_buff, &sbuf) < 0){
|
|
|
6fdc0f |
if(errno != ENOENT){
|
|
|
6fdc0f |
perror("stat");
|