oysteikt/mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

db/update/Archive: validate directory names

Browse Source 
Fixes assertion failure if the ZIP file contains a path that begins
with a slash.

Closes https://github.com/MusicPlayerDaemon/MPD/issues/1793
This commit is contained in:
Max Kellermann 2023-04-30 08:42:32 +02:00
parent e84db4f411
commit 31dc8b73b7
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -14,6 +14,7 @@ ver 0.24 (not yet released)
- proxy: require libmpdclient 2.15 or later - proxy: require libmpdclient 2.15 or later
* archive * archive
- add option to disable archive plugins in mpd.conf - add option to disable archive plugins in mpd.conf
- zzip: fix crash bug
* input * input
- curl: add "connect_timeout" configuration - curl: add "connect_timeout" configuration
- curl: fix busy loop after connection failed - curl: fix busy loop after connection failed

3
src/db/update/Archive.cxx
View File

@ -50,6 +50,9 @@ UpdateWalk::UpdateArchiveTree(ArchiveFile &archive, Directory &directory,
{ {
const auto [child_name, rest] = Split(name, '/'); const auto [child_name, rest] = Split(name, '/');
if (rest.data() != nullptr) { if (rest.data() != nullptr) {
if (!IsAcceptableFilename(child_name))
return;
//add dir is not there already //add dir is not there already
Directory *subdir = LockMakeChild(directory, child_name); Directory *subdir = LockMakeChild(directory, child_name);
subdir->device = DEVICE_INARCHIVE; subdir->device = DEVICE_INARCHIVE;