Changeset 9829 for branches

Timestamp:

Dec 28, 2009, 12:35:27 AM (13 years ago)

Author:

charles

Message:

(1.7x libT) ​https://bugs.launchpad.net/ubuntu/+source/transmission/+bug/500625

File:

• branches/1.7x/libtransmission/metainfo.c (modified) (5 diffs)

branches/1.7x/libtransmission/metainfo.c

@@ -137 +137 @@
 
 static tr_bool
-getfile( char        ** setme,
-         const char   * root,
-         tr_benc      * path )
+path_is_suspicious( const char * path )
+{
+    return ( path == NULL )
+        || ( strstr( path, "../" ) != NULL );
+}
+
+static tr_bool
+getfile( char ** setme, const char * root, tr_benc * path )
 {
     tr_bool success = FALSE;
@@ -145 +150 @@
     if( tr_bencIsList( path ) )
     {
+        int i;
+        const int n = tr_bencListSize( path );
         struct evbuffer * buf = evbuffer_new( );
-        int               n = tr_bencListSize( path );
-        int               i;
 
         evbuffer_add( buf, root, strlen( root ) );
@@ -153 +158 @@
         {
             const char * str;
-            if( tr_bencGetStr( tr_bencListChild( path, i ), &str )
-              && strcmp( str, ".." ) )
+            if( tr_bencGetStr( tr_bencListChild( path, i ), &str ) )
             {
                 evbuffer_add( buf, TR_PATH_DELIMITER_STR, 1 );
@@ -167 +171 @@
     }
 
+    if( ( *setme != NULL ) && path_is_suspicious( *setme ) )
+    {
+        tr_free( *setme );
+        *setme = NULL;
+        success = FALSE;
+    }
+
     return success;
 }
@@ -212 +223 @@
     else if( tr_bencGetInt( length, &len ) ) /* single-file mode */
     {
+        if( path_is_suspicious( inf->name ) )
+            return "path";
+
         inf->isMultifile      = 0;
         inf->fileCount        = 1;