shithub: scc

Info  •  Files  •  Log  •  Branches

[ar] Check filenames before processing archive

--- a/src/cmd/ar.c

+++ b/src/cmd/ar.c

@@ -119,8 +119,6 @@

 	if (vflag)

 		printf("%c - %s\n", letter, fname);

-	if (strlen(fname) > 16)

-		fprintf(stderr, "ar: %s: name too long, truncated\n", fname);

 	if ((from = fopen(pname, "rb")) == NULL)

 		error("opening member '%s': %s", pname, errstr());

 	if (getstat(pname, &prop) < 0)

@@ -548,6 +546,22 @@

 }

 static void

+checkfnames(int argc, char *argv[])

+{

+	size_t l;

+	char *p;

+

+	for ( ; argc-- > 0; ++argv) {

+		p = canonical(*argv);

+		l = strcspn(p, invalidchars);

+		if (l > 16)

+			error("file: '%s': name too long", *argv);

+		if (p[l] != '\0')

+			error("file: '%s': name invalid", *argv);

+	}

+}

+

+static void

 usage(void)

 {

 	fputs("ar [-drqtpmx][posname] [-vuaibcl] [posname] arfile name ...\n",

@@ -628,7 +642,8 @@

 	signal(SIGTERM, sigfun);

 	arfile = *argv;

-	ar(key, ++argv, --argc);

+	checkfnames(--argc, ++argv);

+	ar(key, argv, argc);

 	fflush(stdout);

 	if (ferror(stdout))

--- a/src/cmd/posix.c

+++ b/src/cmd/posix.c

@@ -9,6 +9,8 @@

 #include "sys.h"

+const char invalidchars[] = " ";

+

 time_t

 totime(long long t)

 {

--- a/src/cmd/sys.h

+++ b/src/cmd/sys.h

@@ -6,6 +6,8 @@

 	time_t time;

 };

+extern const char invalidchars[];

+

 extern time_t totime(long long t);

 extern char *canonical(char *path);

 extern int getstat(char *fname, struct fprop *prop);