mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2024-11-25 01:55:19 +01:00
pax: Terminate loop for empty directory names
Pax can sometimes loop forever. For example: $ mkdir -p /tmp/src/foo/bar $ rm -rf /tmp/dst ; mkdir -p /tmp/dst $ cd /tmp/src $ echo 'foo/bar/' | /bin/pax -r -w -d -pe "/tmp/dst" <looping infinitely> Here, pax(1) infinitely deletes and re-creates /tmp/dst/foo/bar/. The problem is that chk_path() (bin/pax/file_subs.c), called from node_creat() also creates the leaf directory when a trailing '/' appears in the directory name to create. When the execution goes back from chk_path() to node_creat(), the function still cannot create the leaf directory (it has been created by chk_path()), so it unlinks it and calls node_creat() again. The function re-creates it, and so on... In node_creat() detect trailing slashes and not create a leaf directory, but only intermediate ones. PR: 277060 Reviewed by: imp
This commit is contained in:
parent
5a969a3459
commit
681fd2bed8
@ -555,7 +555,12 @@ chk_path( char *name, uid_t st_uid, gid_t st_gid)
|
||||
* work forward from the first / and check each part of the path
|
||||
*/
|
||||
spt = strchr(spt, '/');
|
||||
if (spt == NULL)
|
||||
|
||||
/*
|
||||
* skip creating a leaf dir (with an ending '/') as we only want
|
||||
* to create parents here
|
||||
*/
|
||||
if ((spt == NULL) || (*(spt + 1) == '\0'))
|
||||
break;
|
||||
*spt = '\0';
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user