Changeset 93228 in vbox for trunk

Timestamp:

Jan 13, 2022 4:29:42 PM (3 years ago)

Author:

vboxsync

Message:

NAT/tftp: bugref:9350 - Fix the ".." check.

File:

• trunk/src/VBox/Devices/Network/slirp/tftp.c (modified) (1 diff)

trunk/src/VBox/Devices/Network/slirp/tftp.c

@@ -156 +156 @@
         *s++ = '/';
 
-    /* deny attempts to break out of tftp dir */
-    if (RTStrStartsWith(pTftpSession->szFilename, "../"))
+    /* deny dot-dot by itself or at the beginning */
+    if (   pTftpSession->szFilename[0] == '.'
+        && pTftpSession->szFilename[1] == '.'
+        && (   pTftpSession->szFilename[2] == '\0'
+            || pTftpSession->szFilename[2] == '/'))
         goto done;
 
+    /* deny dot-dot in the middle */
+    if (RTStrStr(pTftpSession->szFilename, "/../") != NULL)
+        goto done;
+
+    /* deny dot-dot at the end (there's no RTStrEndsWith) */
     const char *dotdot = RTStrStr(pTftpSession->szFilename, "/..");
-    if (dotdot != NULL && (dotdot[3] == '/' || dotdot[3] == '\0'))
+    if (dotdot != NULL && dotdot[3] == '\0')
         goto done;