conf: reject absolute include paths containing /../

input_stdio_open() previously opened any absolute path without checking
for path traversal. Reject paths that contain "/../" so a planted config
cannot read arbitrary files.

Closes: https://github.com/alsa-project/alsa-lib/pull/527
Signed-off-by: Harsh Raj Singhania <raj.harshraut@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/src/conf.c b/src/conf.c
index a27e6786e79e64437a0f6160b1e161595c52752e..1469c7edc959060551f0be85f1e968b63d958f2f 100644 (file)
--- a/src/conf.c
+++ b/src/conf.c
@@ -643,8 +643,11 @@ static int input_stdio_open(snd_input_t **inputp, const char *file,
        char full_path[PATH_MAX];
        int err;
 
-       if (file[0] == '/')
+       if (file[0] == '/') {
+               if (strstr(file, "/../"))
+                       return -ENOENT;
                return snd_input_stdio_open(inputp, file, "r");
+       }
 
        /* search file in user specified include paths. These directories
         * are subdirectories of /usr/share/alsa.