moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-24 09:08:49 -05:00
Code Issues Releases Wiki Activity

file: on Windows, refuse paths that start with \\

Browse Source 
... as that might cause an unexpected SMB connection to a given host
name.

Reported-by: Fernando Muñoz
CVE-2019-15601
Bug: https://curl.haxx.se/docs/CVE-2019-15601.html
This commit is contained in:
Daniel Stenberg 2019-11-07 10:13:01 +01:00
parent aeb32d059b
commit 1b71bc532b
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/file.c
View File

@ -136,7 +136,7 @@ static CURLcode file_connect(struct connectdata *conn, bool *done)
struct Curl_easy *data = conn->data; struct Curl_easy *data = conn->data;
char *real_path; char *real_path;
struct FILEPROTO *file = data->req.protop; struct FILEPROTO *file = data->req.protop;
int fd; int fd = -1;
#ifdef DOS_FILESYSTEM #ifdef DOS_FILESYSTEM
size_t i; size_t i;
char *actual_path; char *actual_path;
@ -181,7 +181,9 @@ static CURLcode file_connect(struct connectdata *conn, bool *done)
return CURLE_URL_MALFORMAT; return CURLE_URL_MALFORMAT;
} }
fd = open_readonly(actual_path, O_RDONLY|O_BINARY); if(strncmp("\\\\", actual_path, 2))
/* refuse to open path that starts with two backslashes */
fd = open_readonly(actual_path, O_RDONLY|O_BINARY);
file->path = actual_path; file->path = actual_path;
#else #else
if(memchr(real_path, 0, real_path_len)) { if(memchr(real_path, 0, real_path_len)) {