From 3a296a5fe6c06deb497b09ab29b8363761b2885d Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 30 Apr 2015 19:44:10 +0200 Subject: [PATCH] util: be a bit safer in path_is_safe() We should be more strict when verifying paths with path_is_safe() for potentially dangerous constructs, and that includes lengths of PATH_MAX-1 and larger. Be more accurate here. --- src/shared/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/util.c b/src/shared/util.c index 693bb1d9a..f904d0325 100644 --- a/src/shared/util.c +++ b/src/shared/util.c @@ -3918,7 +3918,7 @@ bool path_is_safe(const char *p) { if (streq(p, "..") || startswith(p, "../") || endswith(p, "/..") || strstr(p, "/../")) return false; - if (strlen(p) > PATH_MAX) + if (strlen(p)+1 > PATH_MAX) return false; /* The following two checks are not really dangerous, but hey, they still are confusing */ -- 2.30.2