Gerd Hoffmann c52d46e041 usb-mtp: outlaw slashes in filenames ...

Slash is unix directory separator, so they are not allowed in filenames.
Note this also stops the classic escape via "../".

Fixes: CVE-2018-16867
Reported-by: Michael Hanselmann <public@hansmi.ch>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181203101045.27976-3-kraxel@redhat.com

2018-12-03 19:40:17 +01:00

60 KiB

Raw Blame History

View Raw