|
 |
7331615 |
Fix for CAN-2004-0175, based on Markus Friedl's fix for OpenSSH scp.
|
|
|
7331615 |
|
|
|
7331615 |
--- krb5-1.3.3/src/appl/bsd/krcp.c 2003-05-12 18:20:15.000000000 -0400
|
|
|
7331615 |
+++ krb5-1.3.3/src/appl/bsd/krcp.c 2004-04-13 12:01:31.000000000 -0400
|
|
|
7331615 |
@@ -1088,6 +1088,10 @@
|
|
|
7331615 |
size = size * 10 + (*cp++ - '0');
|
|
|
7331615 |
if (*cp++ != ' ')
|
|
|
7331615 |
SCREWUP("size not delimited");
|
|
|
7331615 |
+ if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
|
|
|
7331615 |
+ error("error: unexpected filename: %s", cp);
|
|
|
7331615 |
+ exit(1);
|
|
|
7331615 |
+ }
|
|
|
7331615 |
if (targisdir) {
|
|
|
7331615 |
if(strlen(targ) + strlen(cp) + 2 >= sizeof(nambuf))
|
|
|
7331615 |
SCREWUP("target name too long");
|
|
|
7331615 |
@@ -1101,6 +1105,8 @@
|
|
|
7331615 |
nambuf[sizeof(nambuf) - 1] = '\0';
|
|
|
7331615 |
exists = stat(nambuf, &stb) == 0;
|
|
|
7331615 |
if (cmdbuf[0] == 'D') {
|
|
|
7331615 |
+ if (!iamrecursive)
|
|
|
7331615 |
+ SCREWUP("received directory without -r");
|
|
|
7331615 |
if (exists) {
|
|
|
7331615 |
if ((stb.st_mode&S_IFMT) != S_IFDIR) {
|
|
|
7331615 |
errno = ENOTDIR;
|
|
|
7331615 |
--- krb5-1.3.3/src/appl/bsd/v4rcp.c 2002-07-12 16:21:31.000000000 -0400
|
|
|
7331615 |
+++ krb5-1.3.3/src/appl/bsd/v4rcp.c 2004-04-13 12:01:53.000000000 -0400
|
|
|
7331615 |
@@ -801,6 +801,10 @@
|
|
|
7331615 |
size = size * 10 + (*cp++ - '0');
|
|
|
7331615 |
if (*cp++ != ' ')
|
|
|
7331615 |
SCREWUP("size not delimited");
|
|
|
7331615 |
+ if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
|
|
|
7331615 |
+ error("error: unexpected filename: %s", cp);
|
|
|
7331615 |
+ exit(1);
|
|
|
7331615 |
+ }
|
|
|
7331615 |
if (targisdir) {
|
|
|
7331615 |
if (strlen(targ) + strlen(cp) + 1 < sizeof(nambuf)) {
|
|
|
7331615 |
(void) sprintf(nambuf, "%s%s%s", targ,
|
|
|
7331615 |
@@ -817,6 +821,8 @@
|
|
|
7331615 |
nambuf[sizeof(nambuf)-1] = '\0';
|
|
|
7331615 |
exists = stat(nambuf, &stb) == 0;
|
|
|
7331615 |
if (cmdbuf[0] == 'D') {
|
|
|
7331615 |
+ if (!iamrecursive)
|
|
|
7331615 |
+ SCREWUP("received directory without -r");
|
|
|
7331615 |
if (exists) {
|
|
|
7331615 |
if ((stb.st_mode&S_IFMT) != S_IFDIR) {
|
|
|
7331615 |
errno = ENOTDIR;
|