Fix checks on TFTP filenames to avoid directory escape.

Commit d152e81 which fixed escape via pathname of the form "file/.."
introduced a new bug in which pathnames of the form "file/..dir/.."
are not caught.

Note that to be a practical attack, a directory with name
"..somename" has to exist the correct place in the tree.
This seems unlikely on most systems, and a it's difficult to see
how an attacker could create such a directory and not already have
the read access that it gives them.

Thanks to Mario Madersbacher for spotting this, and supplying a very
complete report and patch.

src/tftp.c

@@ -545,10 +545,17 @@ static struct tftp_file *check_tftp_fileperm(char *packet, ssize_t *len, char *p
   /* trick to ban moving out of the subtree */
   if (prefix)
     {
-      char *suspect = strstr(namebuff, "/..");
+      char *suspect = namebuff;
 
-      if (suspect && (suspect[3] == '/' || suspect[3] == 0))
-        goto perm;
+      /* Every occurrence has to be checked: a harmless leading match
+         such as "/..data" otherwise hides a later "/../" from here. */
+      while ((suspect = strstr(suspect, "/..")))
+        {
+          if (suspect[3] == '/' || suspect[3] == 0)
+            goto perm;
+
+          suspect += 3;
+        }
     }
   
   if ((fd = open(namebuff, O_RDONLY)) == -1)