db/update/Archive: validate directory names

Fixes assertion failure if the ZIP file contains a path that begins
with a slash.

Closes https://github.com/MusicPlayerDaemon/MPD/issues/1793
This commit is contained in:
Max Kellermann
2023-04-30 08:42:32 +02:00
parent e84db4f411
commit 31dc8b73b7
2 changed files with 4 additions and 0 deletions

View File

@@ -50,6 +50,9 @@ UpdateWalk::UpdateArchiveTree(ArchiveFile &archive, Directory &directory,
{
const auto [child_name, rest] = Split(name, '/');
if (rest.data() != nullptr) {
if (!IsAcceptableFilename(child_name))
return;
//add dir is not there already
Directory *subdir = LockMakeChild(directory, child_name);
subdir->device = DEVICE_INARCHIVE;