oysteikt/mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

directory: check the absolute path of a subdirectory while loading

Browse Source 
A manipulated database could trigger an assertion failure, because the
parent didn't match.  Do a proper check if the new directory is within
the parent's.  This uses FATAL() to bail out, so MPD still dies, but
it doesn't crash.
This commit is contained in:
Max Kellermann 2008-10-09 15:35:34 +02:00
parent cbc0764613
commit 702739b879
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/directory_save.c
View File

@ -84,6 +84,10 @@ directory_load(FILE *fp, struct directory *directory)
if (prefixcmp(buffer, DIRECTORY_BEGIN))
FATAL("Error reading db at line: %s\n", buffer);
name = &(buffer[strlen(DIRECTORY_BEGIN)]);
if (prefixcmp(name, directory->path) != 0)
FATAL("Wrong path in database: '%s' in '%s'\n",
name, directory->path);
if ((subdir = db_get_directory(name))) {
assert(subdir->parent == directory);
} else {