mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-31 13:10:35 +00:00
Mario Madersbacher
2463798e03
Commit d152e81 which fixed escape via pathname of the form "file/.."
introduced a new bug in which pathnames of the form "file/..dir/.."
are not caught.
Note that to be a practical attack, a directory with name
"..somename" has to exist the correct place in the tree.
This seems unlikely on most systems, and a it's difficult to see
how an attacker could create such a directory and not already have
the read access that it gives them.
Thanks to Mario Madersbacher for spotting this, and supplying a very
complete report and patch.