1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
Index: unarj-2.65/sanitize.c
===================================================================
--- /dev/null
+++ unarj-2.65/sanitize.c
@@ -0,0 +1,81 @@
+/*
+ * Path sanitation code by Ludwig Nussel <ludwig.nussel@suse.de>. Public Domain.
+ */
+
+#include "unarj.h"
+
+#include <string.h>
+#include <limits.h>
+#include <stdio.h>
+
+#ifndef PATH_CHAR
+#define PATH_CHAR '/'
+#endif
+#ifndef MIN
+#define MIN(x,y) ((x)<(y)?(x):(y))
+#endif
+
+/* copy src into dest converting the path to a relative one inside the current
+ * directory. dest must hold at least len bytes */
+void copy_path_relative(char *dest, char *src, size_t len)
+{
+ char* o = dest;
+ char* p = src;
+
+ *o = '\0';
+
+ while(*p && *p == PATH_CHAR) ++p;
+ for(; len && *p;)
+ {
+ src = p;
+ p = strchr(src, PATH_CHAR);
+ if(!p) p = src+strlen(src);
+
+ /* . => skip */
+ if(p-src == 1 && *src == '.' )
+ {
+ if(*p) src = ++p;
+ }
+ /* .. => pop one */
+ else if(p-src == 2 && *src == '.' && src[1] == '.')
+ {
+ if(o != dest)
+ {
+ char* tmp;
+ *o = '\0';
+ tmp = strrchr(dest, PATH_CHAR);
+ if(!tmp)
+ {
+ len += o-dest;
+ o = dest;
+ if(*p) ++p;
+ }
+ else
+ {
+ len += o-tmp;
+ o = tmp;
+ if(*p) ++p;
+ }
+ }
+ else /* nothing to pop */
+ if(*p) ++p;
+ }
+ else
+ {
+ size_t copy;
+ if(o != dest)
+ {
+ --len;
+ *o++ = PATH_CHAR;
+ }
+ copy = MIN(p-src,len);
+ memcpy(o, src, copy);
+ len -= copy;
+ src += copy;
+ o += copy;
+ if(*p) ++p;
+ }
+ while(*p && *p == PATH_CHAR) ++p;
+ }
+ o[len?0:-1] = '\0';
+}
Index: unarj-2.65/unarj.c
===================================================================
--- unarj-2.65.orig/unarj.c
+++ unarj-2.65/unarj.c
@@ -235,6 +235,8 @@ static UCRC crctable[UCHAR_MAX + 1];
/* Functions */
+void copy_path_relative(char *dest, char *src, size_t len);
+
static void
make_crctable()
{
@@ -738,11 +740,11 @@ extract()
no_output = 0;
if (command == 'E')
- strncopy(name, &filename[entry_pos], sizeof(name));
+ copy_path_relative(name, &filename[entry_pos], sizeof(name));
else
{
strcpy(name, DEFAULT_DIR);
- strncopy(name+strlen(name), filename, sizeof(name)-strlen(name));
+ copy_path_relative(name+strlen(name), filename, sizeof(name)-strlen(name));
}
if (host_os != OS)
--- unarj-2.65.orig/Makefile Mon Nov 29 16:47:24 2004
+++ unarj-2.65/Makefile Mon Nov 29 22:46:56 2004
@@ -9,7 +9,9 @@
decode.o: decode.c unarj.h
-OBJS = unarj.o decode.o environ.o
+sanitize.o: sanitize.c unarj.h
+
+OBJS = unarj.o decode.o environ.o sanitize.o
unarj: $(OBJS)
$(CC) $(LDFLAGS) $(OBJS) -o unarj
|
GitWeb