shithub: scc

Download patch

ref: 914c674f1eec2150b7d2c2bb8066c023c66878dd
parent: abef896b724bbd7f0f2ef2c80df4f479dfac297d
author: Quentin Rameau <[email protected]>
date: Fri Jan 11 08:57:56 EST 2019

[ar] Check filenames before processing archive

--- a/src/cmd/ar.c
+++ b/src/cmd/ar.c
@@ -119,8 +119,6 @@
 
 	if (vflag)
 		printf("%c - %s\n", letter, fname);
-	if (strlen(fname) > 16)
-		fprintf(stderr, "ar: %s: name too long, truncated\n", fname);
 	if ((from = fopen(pname, "rb")) == NULL)
 		error("opening member '%s': %s", pname, errstr());
 	if (getstat(pname, &prop) < 0)
@@ -548,6 +546,22 @@
 }
 
 static void
+checkfnames(int argc, char *argv[])
+{
+	size_t l;
+	char *p;
+
+	for ( ; argc-- > 0; ++argv) {
+		p = canonical(*argv);
+		l = strcspn(p, invalidchars);
+		if (l > 16)
+			error("file: '%s': name too long", *argv);
+		if (p[l] != '\0')
+			error("file: '%s': name invalid", *argv);
+	}
+}
+
+static void
 usage(void)
 {
 	fputs("ar [-drqtpmx][posname] [-vuaibcl] [posname] arfile name ...\n",
@@ -628,7 +642,8 @@
 	signal(SIGTERM, sigfun);
 
 	arfile = *argv;
-	ar(key, ++argv, --argc);
+	checkfnames(--argc, ++argv);
+	ar(key, argv, argc);
 
 	fflush(stdout);
 	if (ferror(stdout))
--- a/src/cmd/posix.c
+++ b/src/cmd/posix.c
@@ -9,6 +9,8 @@
 
 #include "sys.h"
 
+const char invalidchars[] = " ";
+
 time_t
 totime(long long t)
 {
--- a/src/cmd/sys.h
+++ b/src/cmd/sys.h
@@ -6,6 +6,8 @@
 	time_t time;
 };
 
+extern const char invalidchars[];
+
 extern time_t totime(long long t);
 extern char *canonical(char *path);
 extern int getstat(char *fname, struct fprop *prop);