diff options
| author | Miklos Szeredi <mszeredi@suse.cz> | 2013-09-03 14:28:38 +0200 |
|---|---|---|
| committer | Miklos Szeredi <mszeredi@suse.cz> | 2013-09-03 14:28:38 +0200 |
| commit | efeb9e60d48f7778fdcad4a0f3ad9ea9b19e5dfd (patch) | |
| tree | 3cade63dc511e557d9f99cfb810d2d3c64351e4b /fs | |
| parent | 06a7c3c2781409af95000c60a5df743fd4e2f8b4 (diff) | |
| download | linux-efeb9e60d48f7778fdcad4a0f3ad9ea9b19e5dfd.tar.gz linux-efeb9e60d48f7778fdcad4a0f3ad9ea9b19e5dfd.tar.bz2 linux-efeb9e60d48f7778fdcad4a0f3ad9ea9b19e5dfd.zip | |
fuse: readdir: check for slash in names
Userspace can add names containing a slash character to the directory
listing. Don't allow this as it could cause all sorts of trouble.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Cc: stable@vger.kernel.org
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/fuse/dir.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c index c8334f75c8c9..8fec28ff4a0d 100644 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -1174,6 +1174,8 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file, return -EIO; if (reclen > nbytes) break; + if (memchr(dirent->name, '/', dirent->namelen) != NULL) + return -EIO; if (!dir_emit(ctx, dirent->name, dirent->namelen, dirent->ino, dirent->type)) @@ -1320,6 +1322,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file, return -EIO; if (reclen > nbytes) break; + if (memchr(dirent->name, '/', dirent->namelen) != NULL) + return -EIO; if (!over) { /* We fill entries into dstbuf only as much as |