sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-16 09:57:47 +03:00
Code

mount.cifs: check for invalid characters in device name and mountpoint

Browse Source 
It's apparently possible to corrupt the mtab if you pass embedded
newlines to addmntent. Apparently tabs are also a problem with certain
earlier glibc versions. Backslashes are also a minor issue apparently,
but we can't reasonably filter those.

Make sure that neither the devname or mountpoint contain any problematic
characters before allowing the mount to proceed.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
This commit is contained in:
Jeff Layton 2010-01-26 08:15:41 -05:00
parent 3ae5dac462
commit a065c177df
1 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
client/mount.cifs.c
View File

@ -1164,6 +1164,36 @@ static void print_cifs_mount_version(void)
MOUNT_CIFS_VENDOR_SUFFIX);
}
/*
* This function borrowed from fuse-utils...
*
* glibc's addmntent (at least as of 2.10 or so) doesn't properly encode
* newlines embedded within the text fields. To make sure no one corrupts
* the mtab, fail the mount if there are embedded newlines.
*/
static int check_newline(const char *progname, const char *name)
{
char *s;
for (s = "\n"; *s; s++) {
if (strchr(name, *s)) {
fprintf(stderr, "%s: illegal character 0x%02x in mount entry\n",
progname, *s);
return EX_USAGE;
}
}
return 0;
}
static int check_mtab(const char *progname, const char *devname,
const char *dir)
{
if (check_newline(progname, devname) == -1 ||
check_newline(progname, dir) == -1)
return EX_USAGE;
return 0;
}
int main(int argc, char ** argv)
{
int c;
@ -1607,6 +1637,10 @@ mount_retry:
if (verboseflag)
fprintf(stderr, "\n");
rc = check_mtab(thisprogram, dev_name, mountpoint);
if (rc)
goto mount_exit;
if (!fakemnt && mount(dev_name, ".", cifs_fstype, flags, options)) {
switch (errno) {
case ECONNREFUSED: