romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 16:53:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl: avoid local drive traversal when saving file (Windows)

Browse source 
curl does not sanitize colons in a remote file name that is used as the
local file name. This may lead to a vulnerability on systems where the
colon is a special path character. Currently Windows/DOS is the only OS
where this vulnerability applies.

CVE-2016-0754

Bug: http://curl.haxx.se/docs/adv_20160127B.html
This commit is contained in:
Ray Satiro 2016-01-26 23:23:15 +01:00 • committed by Daniel Stenberg
parent cea1fd7a94
commit 3017d8a8d8
4 changed files with 187 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

29
src/tool_operate.c
View file

@ -543,26 +543,37 @@ static CURLcode operate_do(struct GlobalConfig *global,
result = get_url_file_name(&outfile, this_url);
if(result)
goto show_error;
#if defined(MSDOS) || defined(WIN32)
result = sanitize_file_name(&outfile);
if(result) {
Curl_safefree(outfile);
goto show_error;
}
#endif /* MSDOS || WIN32 */
if(!*outfile && !config->content_disposition) {
helpf(global->errors, "Remote file name has no length!\n");
result = CURLE_WRITE_ERROR;
goto quit_urls;
}
#if defined(MSDOS) || defined(WIN32)
/* For DOS and WIN32, we do some major replacing of
bad characters in the file name before using it */
outfile = sanitize_dos_name(outfile);
if(!outfile) {
result = CURLE_OUT_OF_MEMORY;
goto show_error;
}
#endif /* MSDOS || WIN32 */
}
else if(urls) {
/* fill '#1' ... '#9' terms from URL pattern */
char *storefile = outfile;
result = glob_match_url(&outfile, storefile, urls);
Curl_safefree(storefile);
#if defined(MSDOS) || defined(WIN32)
if(!result) {
result = sanitize_file_name(&outfile);
if(result) {
Curl_safefree(outfile);
goto show_error;
}
}
#endif /* MSDOS || WIN32 */
if(result) {
/* bad globbing */
warnf(config->global, "bad output glob!\n");