oysteikt
/
mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

db/update/Archive: validate directory names 

Fixes assertion failure if the ZIP file contains a path that begins
with a slash.

Closes https://github.com/MusicPlayerDaemon/MPD/issues/1793
This commit is contained in:
Max Kellermann 2023-04-30 08:42:32 +02:00
parent 96befa138c
commit 1417578b3d
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -1,6 +1,8 @@
ver 0.23.13 (not yet released) ver 0.23.13 (not yet released)
* input * input
- curl: fix busy loop after connection failed - curl: fix busy loop after connection failed
* archive
- zzip: fix crash bug
* decoder * decoder
- gme: require GME 0.6 or later - gme: require GME 0.6 or later
* output * output

3
src/db/update/Archive.cxx
View File

@ -67,6 +67,9 @@ UpdateWalk::UpdateArchiveTree(ArchiveFile &archive, Directory &directory,
const char *tmp = std::strchr(name, '/'); const char *tmp = std::strchr(name, '/');
if (tmp) { if (tmp) {
const std::string_view child_name(name, tmp - name); const std::string_view child_name(name, tmp - name);
if (!IsAcceptableFilename(child_name))
return;
//add dir is not there already //add dir is not there already
Directory *subdir = LockMakeChild(directory, child_name); Directory *subdir = LockMakeChild(directory, child_name);
subdir->device = DEVICE_INARCHIVE; subdir->device = DEVICE_INARCHIVE;