]> git.alsa-project.org Git - alsa-lib.git/commit
projects / alsa-lib.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: f84cd4c) | patch
conf: reject absolute include paths containing /../
authorHarsh Raj Singhania <raj.harshraut@gmail.com>
Wed, 30 Sep 2026 18:57:56 +0000 (00:27 +0530)
committerTakashi Iwai <tiwai@suse.de>
Thu, 15 Oct 2026 13:28:12 +0000 (15:28 +0200)
commitf5377bbb572d88d9a59eee8ae26bff30d5a2ebb3
treea468f7163ea9ac66dfece59ffa2a2068ced94305tree | snapshot
parentf84cd4ced7b36fddb8e4ee24404cf7c091d27020commit | diff
conf: reject absolute include paths containing /../

input_stdio_open() previously opened any absolute path without checking
for path traversal. Reject paths that contain "/../" so a planted config
cannot read arbitrary files.

Closes: https://github.com/alsa-project/alsa-lib/pull/527
Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
src/conf.c diff | blob | history
ALSA library repository