Attachment #43788 for bug #70966




/*
 * Path sanitation code by Ludwig Nussel <ludwig.nussel@suse.de>. Public Domain.
 */

#include "unarj.h"

#include <string.h>
#include <limits.h>
#include <stdio.h>

#ifndef PATH_CHAR
#define PATH_CHAR '/'
#endif
#ifndef MIN
#define MIN(x,y) ((x)<(y)?(x):(y))
#endif

/* copy src into dest converting the path to a relative one inside the current
 * directory. dest must hold at least len bytes */
void copy_path_relative(char *dest, char *src, size_t len)
{
    char* o = dest;
    char* p = src;

    *o = '\0';

    while(*p && *p == PATH_CHAR) ++p;
    for(; len && *p;)
    {
	src = p;
	p = strchr(src, PATH_CHAR);
	if(!p) p = src+strlen(src);

	/* . => skip */
	if(p-src == 1 && *src == '.' )
	{
	    if(*p) src = ++p;
	}
	/* .. => pop one */
	else if(p-src == 2 && *src == '.' && src[1] == '.')
	{
	    if(o != dest)
	    {
		char* tmp;
		*o = '\0';
		tmp = strrchr(dest, PATH_CHAR);
		if(!tmp)
		{
		    len += o-dest;
		    o = dest;
		    if(*p) ++p;
		}
		else
		{
		    len += o-tmp;
		    o = tmp;
		    if(*p) ++p;
		}
	    }
	    else /* nothing to pop */
		if(*p) ++p;
	}
	else
	{
	    size_t copy;
	    if(o != dest)
	    {
		--len;
		*o++ = PATH_CHAR;
	    }
	    copy = MIN(p-src,len);
	    memcpy(o, src, copy);
	    len -= copy;
	    src += copy;
	    o += copy;
	    if(*p) ++p;
	}
	while(*p && *p == PATH_CHAR) ++p;
    }
    o[len?0:-1] = '\0';
}

Lines 235-240 static UCRC crctable[UCHAR_MAX + 1]; Link Here

(-)unarj-2.65/unarj.c (-2 / +4 lines)
235		235
236	/* Functions */	236	/* Functions */
237		237
		238	void copy_path_relative(char dest, char src, size_t len);
		239
238	static void	240	static void
239	make_crctable()	241	make_crctable()
240	{	242	{
Lines 738-748 extract() Link Here
738		740
739	no_output = 0;	741	no_output = 0;
740	if (command == 'E')	742	if (command == 'E')
741	strncopy(name, &filename[entry_pos], sizeof(name));	743	copy_path_relative(name, &filename[entry_pos], sizeof(name));
742	else	744	else
743	{	745	{
744	strcpy(name, DEFAULT_DIR);	746	strcpy(name, DEFAULT_DIR);
745	strncopy(name+strlen(name), filename, sizeof(name)-strlen(name));	747	copy_path_relative(name+strlen(name), filename, sizeof(name)-strlen(name));
746	}	748	}
747		749
748	if (host_os != OS)	750	if (host_os != OS)

Lines 6-13 CC = gcc Link Here

(-)unarj-2.65/Makefile (-2 / +3 lines)
6	CFLAGS = -O2 -Wall -ansi -pedantic -DUNIX	6	CFLAGS = -O2 -Wall -ansi -pedantic -DUNIX
7	INSTALLDIR=/usr/local/bin	7	INSTALLDIR=/usr/local/bin
8		8
9	unarj: unarj.o decode.o environ.o	9	unarj: unarj.o decode.o environ.o sanitize.o
10	$(CC) $(CFLAGS) -o unarj unarj.o decode.o environ.o	10	$(CC) $(CFLAGS) -o unarj unarj.o decode.o environ.o sanitize.o
11	strip unarj	11	strip unarj
12		12
13	clean:	13	clean:
Lines 19-21 install: Link Here
19	unarj.o: unarj.c unarj.h Makefile	19	unarj.o: unarj.c unarj.h Makefile
20	environ.o: environ.c unarj.h Makefile	20	environ.o: environ.c unarj.h Makefile
21	decode.o: decode.c unarj.h Makefile	21	decode.o: decode.c unarj.h Makefile
		22	sanitize.o: sanitize.c unarj.h Makefile

Return to bug 70966

Line 0 Link Here

(-)unarj-2.65/sanitize.c (+81 lines)
		1	/*
		2	* Path sanitation code by Ludwig Nussel <ludwig.nussel@suse.de>. Public Domain.
		3	*/
		4
		5	#include "unarj.h"
		6
		7	#include <string.h>
		8	#include <limits.h>
		9	#include <stdio.h>
		10
		11	#ifndef PATH_CHAR
		12	#define PATH_CHAR '/'
		13	#endif
		14	#ifndef MIN
		15	#define MIN(x,y) ((x)<(y)?(x):(y))
		16	#endif
		17
		18	/* copy src into dest converting the path to a relative one inside the current
		19	* directory. dest must hold at least len bytes */
		20	void copy_path_relative(char dest, char src, size_t len)
		21	{
		22	char* o = dest;
		23	char* p = src;
		24
		25	*o = '\0';
		26
		27	while(p && p == PATH_CHAR) ++p;
		28	for(; len && *p;)
		29	{
		30	src = p;
		31	p = strchr(src, PATH_CHAR);
		32	if(!p) p = src+strlen(src);
		33
		34	/* . => skip */
		35	if(p-src == 1 && *src == '.' )
		36	{
		37	if(*p) src = ++p;
		38	}
		39	/* .. => pop one */
		40	else if(p-src == 2 && *src == '.' && src[1] == '.')
		41	{
		42	if(o != dest)
		43	{
		44	char* tmp;
		45	*o = '\0';
		46	tmp = strrchr(dest, PATH_CHAR);
		47	if(!tmp)
		48	{
		49	len += o-dest;
		50	o = dest;
		51	if(*p) ++p;
		52	}
		53	else
		54	{
		55	len += o-tmp;
		56	o = tmp;
		57	if(*p) ++p;
		58	}
		59	}
		60	else /* nothing to pop */
		61	if(*p) ++p;
		62	}
		63	else
		64	{
65	size_t copy;
66	if(o != dest)
67	{
68	--len;
69	*o++ = PATH_CHAR;
70	}
71	copy = MIN(p-src,len);
72	memcpy(o, src, copy);
73	len -= copy;
74	src += copy;
75	o += copy;
76	if(*p) ++p;
77	}
78	while(p && p == PATH_CHAR) ++p;
79	}
80	o[len?0:-1] = '\0';
81	}