Hi,
On Sun, Dec 25, 2005 at 08:05:40PM -0500, Neil Roeth wrote:
> I'll upload what I have so that the new release can get out there.
> Then, I'll work with you after you get back from vacation to fix the
> hurd bug, which I'd like to do using realpath() with a NULL second
> arg. This is apparently the best way to do it on an architecture that
> has no limit on the path length.
So, we took another look at this, and came up with this patch which is
hopefully the least intrusive.
It makes one assumption, though, namely that systems without MAXPATHLEN
will have a realpath() supporting NULL as second argument. Or at least,
it only fixes it for those systems. I know of no systems which neither
have MAXPATHLEN nor are using glibc. If you think this is not totally
kosher, we could add some #ifdef(__GLIBC__) maybe, but I don't think
this is necessary and would only make the code less readable.
Another thing is that realDirs and realOutputDir only get free'd when
the checks succeed. This should not matter as otherwise exit(1) gets
called, but might make valgrind unhappy. If this is unacceptable for
opensp, I can update the patch to also free() them in that case.
cheers,
Michael
--
Michael Banck
Debian Developer
[EMAIL PROTECTED]
http://www.advogato.org/person/mbanck/diary.html
--- opensp-1.5.2.orig/sx/XmlOutputEventHandler.cxx
+++ opensp-1.5.2/sx/XmlOutputEventHandler.cxx
@@ -1199,12 +1199,22 @@
// Check to make sure we haven't passed outside of the
// output directory
char *dirs = strdup (filePath);
+#ifdef MAXPATHLEN
char realDirs[MAXPATHLEN];
char realOutputDir[MAXPATHLEN];
+#else
+ char *realDirs;
+ char *realOutputDir;
+#endif
char *outputDir = strdup(outputDir_);
+#ifdef MAXPATHLEN
realpath((const char *)dirname(dirs), realDirs);
realpath((const char *)dirname(outputDir), realOutputDir);
+#else
+ realDirs = realpath((const char *)dirname(dirs), NULL);
+ realOutputDir = realpath((const char *)dirname(outputDir), NULL);
+#endif
if (strncmp(realDirs, realOutputDir, strlen (realOutputDir)) != 0) {
app_->message(XmlOutputMessages::pathOutsideOutputDirectory,
@@ -1214,6 +1224,11 @@
}
}
+#ifndef MAXPATHLEN
+ free(realDirs);
+ free(realOutputDir);
+#endif
+
// Make the necessary directories
maybeCreateDirectories(dirname(dirs));
