openwrt-mirror/packages
1
0
Fork 0
mirror of https://github.com/openwrt/packages.git synced 2025-12-26 11:16:31 +04:00
Code Issues Packages Projects Releases Wiki Activity

rsync: fix CVE-2017-17433 and CVE-2017-17434

Browse Source 
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
This commit is contained in:
Maxim Storchak
2017-12-30 13:33:40 +02:00
parent f0cef0a021
commit c2d1405919
4 changed files with 86 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
net/rsync/patches/014-sanitize-xname-in-read_ndx_and_attrs.patch Normal file
View File

@@ -0,0 +1,30 @@
commit 70aeb5fddd1b2f8e143276f8d5a085db16c593b9
Author: Jeriko One <jeriko.one@gmx.us>
Date: Thu Nov 16 17:05:42 2017 -0800
Sanitize xname in read_ndx_and_attrs.
diff --git a/rsync.c b/rsync.c
index b82e598..a0945ba 100644
--- a/rsync.c
+++ b/rsync.c
@@ -49,6 +49,7 @@ extern int flist_eof;
extern int file_old_total;
extern int keep_dirlinks;
extern int make_backups;
+extern int sanitize_paths;
extern struct file_list *cur_flist, *first_flist, *dir_flist;
extern struct chmod_mode_struct *daemon_chmod_modes;
#ifdef ICONV_OPTION
@@ -396,6 +397,11 @@ int read_ndx_and_attrs(int f_in, int f_out, int *iflag_ptr, uchar *type_ptr,
if (iflags & ITEM_XNAME_FOLLOWS) {
if ((len = read_vstring(f_in, buf, MAXPATHLEN)) < 0)
exit_cleanup(RERR_PROTOCOL);
+
+ if (sanitize_paths) {
+ sanitize_path(buf, buf, "", 0, SP_DEFAULT);
+ len = strlen(buf);
+ }
} else {
*buf = '\0';
len = -1;