[Bug 8411] Directory traversal via crafted tar file which contains a symlink pointing outside of the current directory

bugzilla at busybox.net bugzilla at busybox.net
Tue Nov 10 00:45:56 UTC 2015


https://bugs.busybox.net/show_bug.cgi?id=8411

--- Comment #10 from Chris Lamb (lamby) <lamby at debian.org> 2015-11-10 00:45:56 UTC ---
> Good point regarding "..foo". I guess that means that
> strstr(file_header->link_target, "../") will unintentionally match a target of
> "foo../bar".

Doh. Although an aside, inadventent matching is "harmless" as it will end up as
symlink just as intended.. but via the placeholder mechanism first. :)

Will update patch tomorrow (UTC+0) with a fresh head.

-- 
Configure bugmail: https://bugs.busybox.net/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


More information about the busybox-cvs mailing list