ref: 914c674f1eec2150b7d2c2bb8066c023c66878dd
parent: abef896b724bbd7f0f2ef2c80df4f479dfac297d
author: Quentin Rameau <[email protected]>
date: Fri Jan 11 08:57:56 EST 2019
[ar] Check filenames before processing archive
--- a/src/cmd/ar.c
+++ b/src/cmd/ar.c
@@ -119,8 +119,6 @@
if (vflag)
printf("%c - %s\n", letter, fname);
- if (strlen(fname) > 16)
- fprintf(stderr, "ar: %s: name too long, truncated\n", fname);
if ((from = fopen(pname, "rb")) == NULL)
error("opening member '%s': %s", pname, errstr());
if (getstat(pname, &prop) < 0)
@@ -548,6 +546,22 @@
}
static void
+checkfnames(int argc, char *argv[])
+{
+ size_t l;
+ char *p;
+
+ for ( ; argc-- > 0; ++argv) {
+ p = canonical(*argv);
+ l = strcspn(p, invalidchars);
+ if (l > 16)
+ error("file: '%s': name too long", *argv);
+ if (p[l] != '\0')
+ error("file: '%s': name invalid", *argv);
+ }
+}
+
+static void
usage(void)
{
fputs("ar [-drqtpmx][posname] [-vuaibcl] [posname] arfile name ...\n",
@@ -628,7 +642,8 @@
signal(SIGTERM, sigfun);
arfile = *argv;
- ar(key, ++argv, --argc);
+ checkfnames(--argc, ++argv);
+ ar(key, argv, argc);
fflush(stdout);
if (ferror(stdout))
--- a/src/cmd/posix.c
+++ b/src/cmd/posix.c
@@ -9,6 +9,8 @@
#include "sys.h"
+const char invalidchars[] = " ";
+
time_t
totime(long long t)
{
--- a/src/cmd/sys.h
+++ b/src/cmd/sys.h
@@ -6,6 +6,8 @@
time_t time;
};
+extern const char invalidchars[];
+
extern time_t totime(long long t);
extern char *canonical(char *path);
extern int getstat(char *fname, struct fprop *prop);