forked from pool/binwalk
d9a6271f5c
- add CVE-2022-4510 patch file: CVE-2022-4510.patch OBS-URL: https://build.opensuse.org/request/show/1062013 OBS-URL: https://build.opensuse.org/package/show/devel:tools/binwalk?expand=0&rev=25
14 lines
882 B
Diff
14 lines
882 B
Diff
Index: src/binwalk/plugins/unpfs.py
|
|
===================================================================
|
|
--- src/binwalk/plugins/unpfs.py.orig 2021-09-10 19:46:40.000000000 +0200
|
|
+++ src/binwalk/plugins/unpfs.py 2023-01-30 10:17:15.441077931 +0100
|
|
@@ -104,7 +104,7 @@ class PFSExtractor(binwalk.core.plugin.P
|
|
data = binwalk.core.common.BlockFile(fname, 'rb')
|
|
data.seek(fs.get_end_of_meta_data())
|
|
for entry in fs.entries():
|
|
- outfile_path = os.path.join(out_dir, entry.fname)
|
|
+ outfile_path = os.path.abspath(os.path.join(out_dir, entry.fname))
|
|
if not outfile_path.startswith(out_dir):
|
|
binwalk.core.common.warning("Unpfs extractor detected directory traversal attempt for file: '%s'. Refusing to extract." % outfile_path)
|
|
else:
|