Changeset 76775 in vbox for trunk/src/VBox

Timestamp:

Jan 11, 2019 1:06:44 PM (6 years ago)

Author:

vboxsync

Message:

NAT/tftp: (bugref:9350) Do not allow access to paths not starting with tftp_prefix.

Location:

trunk/src/VBox/Devices/Network/slirp

Files:

• slirp.c (modified) (3 diffs)
• tftp.c (modified) (2 diffs)

trunk/src/VBox/Devices/Network/slirp/slirp.c

@@ -52 +52 @@
 #include <iprt/assert.h>
 #include <iprt/file.h>
+#include <iprt/path.h>
 #ifndef RT_OS_WINDOWS
 # include <sys/ioctl.h>
@@ -579 +580 @@
     WSACleanup();
 #endif
+    if (tftp_prefix)
+        RTStrFree((char *)tftp_prefix);
 #ifdef LOG_ENABLED
     Log(("\n"
@@ -1664 +1667 @@
 {
     Log2(("tftp_prefix: %s\n", tftpPrefix));
-    tftp_prefix = tftpPrefix;
+    if (tftp_prefix)
+        RTStrFree((char *)tftp_prefix);
+    tftp_prefix = RTPathAbsDup(tftpPrefix);
 }
 

trunk/src/VBox/Devices/Network/slirp/tftp.c

@@ -46 +46 @@
 #include <iprt/file.h>
 #include <iprt/err.h>
+#include <iprt/path.h>
 
 typedef enum ENMTFTPSESSIONFMT
@@ -133 +134 @@
 DECLINLINE(int) tftpSecurityFilenameCheck(PNATState pData, PCTFTPSESSION pcTftpSession)
 {
-    size_t cbSessionFilename = 0;
     int rc = VINF_SUCCESS;
     AssertPtrReturn(pcTftpSession, VERR_INVALID_PARAMETER);
-    cbSessionFilename = RTStrNLen((const char *)pcTftpSession->pszFilename, TFTP_FILENAME_MAX);
-    if (   !RTStrNCmp((const char*)pcTftpSession->pszFilename, "../", 3)
-        || (pcTftpSession->pszFilename[cbSessionFilename - 1] == '/')
-        ||  RTStrStr((const char *)pcTftpSession->pszFilename, "/../"))
-        rc = VERR_FILE_NOT_FOUND;
 
     /* only allow exported prefixes */
-    if (   RT_SUCCESS(rc)
-        && !tftp_prefix)
+    if (!tftp_prefix)
         rc = VERR_INTERNAL_ERROR;
+    else
+    {
+        char *pszFullPathAbs = RTPathAbsExDup(tftp_prefix, (const char*)pcTftpSession->pszFilename);
+
+        if (   !pszFullPathAbs
+            || !RTPathStartsWith(pszFullPathAbs, tftp_prefix))
+            rc = VERR_FILE_NOT_FOUND;
+
+        RTStrFree(pszFullPathAbs);
+    }
     LogFlowFuncLeaveRC(rc);
     return rc;