qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH] 9pfs: add check for relative path
@ 2016-08-11  5:13 P J P
  2016-08-11  6:17 ` no-reply
                   ` (3 more replies)
  0 siblings, 4 replies; 18+ messages in thread
From: P J P @ 2016-08-11  5:13 UTC (permalink / raw)
  To: Qemu Developers
  Cc: Felix Wilhelm, Aneesh Kumar K.V, Greg Kurz, Michael S. Tsirkin,
	Prasad J Pandit

From: Prasad J Pandit <pjp@fedoraproject.org>

At various places in 9pfs back-end, it creates full path by
concatenating two path strings. It could lead to a path
traversal issue if one of the parameter was a relative path.
Add check to avoid it.

Reported-by: Felix Wilhelm <fwilhelm@ernw.de>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/9pfs/9p-local.c | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
index 3f271fc..c20331a 100644
--- a/hw/9pfs/9p-local.c
+++ b/hw/9pfs/9p-local.c
@@ -493,6 +493,9 @@ static int local_mknod(FsContext *fs_ctx, V9fsPath *dir_path,
     char *buffer = NULL;
 
     v9fs_string_init(&fullname);
+    if (strstr(name, "../")) {
+        return err;
+    }
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
     path = fullname.data;
 
@@ -554,6 +557,9 @@ static int local_mkdir(FsContext *fs_ctx, V9fsPath *dir_path,
     char *buffer = NULL;
 
     v9fs_string_init(&fullname);
+    if (strstr(name, "../")) {
+        return err;
+    }
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
     path = fullname.data;
 
@@ -663,6 +669,9 @@ static int local_open2(FsContext *fs_ctx, V9fsPath *dir_path, const char *name,
     flags |= O_NOFOLLOW;
 
     v9fs_string_init(&fullname);
+    if (strstr(name, "../")) {
+        return err;
+    }
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
     path = fullname.data;
 
@@ -734,6 +743,9 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath,
     char *buffer = NULL;
 
     v9fs_string_init(&fullname);
+    if (strstr(name, "../")) {
+        return err;
+    }
     v9fs_string_sprintf(&fullname, "%s/%s", dir_path->data, name);
     newpath = fullname.data;
 
@@ -830,11 +842,14 @@ out:
 static int local_link(FsContext *ctx, V9fsPath *oldpath,
                       V9fsPath *dirpath, const char *name)
 {
-    int ret;
+    int ret = -1;
     V9fsString newpath;
     char *buffer, *buffer1;
 
     v9fs_string_init(&newpath);
+    if (strstr(name, "../")) {
+        return ret;
+    }
     v9fs_string_sprintf(&newpath, "%s/%s", dirpath->data, name);
 
     buffer = rpath(ctx, oldpath->data);
@@ -1059,6 +1074,9 @@ static int local_lremovexattr(FsContext *ctx, V9fsPath *fs_path,
 static int local_name_to_path(FsContext *ctx, V9fsPath *dir_path,
                               const char *name, V9fsPath *target)
 {
+    if (strstr(name, "../")) {
+        return -1;
+    }
     if (dir_path) {
         v9fs_string_sprintf((V9fsString *)target, "%s/%s",
                             dir_path->data, name);
@@ -1074,12 +1092,15 @@ static int local_renameat(FsContext *ctx, V9fsPath *olddir,
                           const char *old_name, V9fsPath *newdir,
                           const char *new_name)
 {
-    int ret;
+    int ret = -1;
     V9fsString old_full_name, new_full_name;
 
     v9fs_string_init(&old_full_name);
     v9fs_string_init(&new_full_name);
 
+    if (strstr(old_name, "../") || strstr(new_name, "../")) {
+        return ret;
+    }
     v9fs_string_sprintf(&old_full_name, "%s/%s", olddir->data, old_name);
     v9fs_string_sprintf(&new_full_name, "%s/%s", newdir->data, new_name);
 
@@ -1092,12 +1113,14 @@ static int local_renameat(FsContext *ctx, V9fsPath *olddir,
 static int local_unlinkat(FsContext *ctx, V9fsPath *dir,
                           const char *name, int flags)
 {
-    int ret;
+    int ret = -1;
     V9fsString fullname;
     char *buffer;
 
     v9fs_string_init(&fullname);
-
+    if (strstr(name, "../")) {
+        return ret;
+    }
     v9fs_string_sprintf(&fullname, "%s/%s", dir->data, name);
     if (ctx->export_flags & V9FS_SM_MAPPED_FILE) {
         if (flags == AT_REMOVEDIR) {
-- 
2.5.5

^ permalink raw reply related	[flat|nested] 18+ messages in thread

end of thread, other threads:[~2016-08-22 15:08 UTC | newest]

Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-11  5:13 [Qemu-devel] [PATCH] 9pfs: add check for relative path P J P
2016-08-11  6:17 ` no-reply
2016-08-11  6:27   ` Fam Zheng
2016-08-18 16:55     ` Greg Kurz
2016-08-11  6:31 ` Aneesh Kumar K.V
2016-08-18 15:19   ` Greg Kurz
2016-08-18 17:06 ` Greg Kurz
2016-08-19 14:55 ` Peter Maydell
2016-08-19 15:14   ` Peter Maydell
2016-08-19 16:37     ` Greg Kurz
2016-08-19 17:03       ` Peter Maydell
2016-08-19 17:30         ` Greg Kurz
2016-08-22  9:23           ` Peter Maydell
2016-08-22 10:07             ` P J P
2016-08-22 15:02             ` Michael S. Tsirkin
2016-08-22 15:07               ` Peter Maydell
2016-08-22 14:14         ` Michael S. Tsirkin
2016-08-19 16:24   ` Greg Kurz

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).