On Thu, Dec 12, 2019 at 04:37:58PM +0000, Dr. David Alan Gilbert (git) wrote: > From: Stefan Hajnoczi <[email protected]> > > Several FUSE requests contain single path components. A correct FUSE > client sends well-formed path components but there is currently no input > validation in case something went wrong or the client is malicious. > > Refuse ".", "..", and paths containing '/' when we expect a path > component. > > Signed-off-by: Stefan Hajnoczi <[email protected]> > --- > tools/virtiofsd/passthrough_ll.c | 59 ++++++++++++++++++++++++++++---- > 1 file changed, 53 insertions(+), 6 deletions(-)
Reviewed-by: Daniel P. Berrangé <[email protected]> Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
