From f5377bbb572d88d9a59eee8ae26bff30d5a2ebb3 Mon Sep 17 00:00:00 2001 From: Harsh Raj Singhania Date: Thu, 1 Oct 2026 00:27:56 +0530 Subject: [PATCH] conf: reject absolute include paths containing /../ input_stdio_open() previously opened any absolute path without checking for path traversal. Reject paths that contain "/../" so a planted config cannot read arbitrary files. Closes: https://github.com/alsa-project/alsa-lib/pull/527 Signed-off-by: Harsh Raj Singhania Signed-off-by: Takashi Iwai --- src/conf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/conf.c b/src/conf.c index a27e6786..1469c7ed 100644 --- a/src/conf.c +++ b/src/conf.c @@ -643,8 +643,11 @@ static int input_stdio_open(snd_input_t **inputp, const char *file, char full_path[PATH_MAX]; int err; - if (file[0] == '/') + if (file[0] == '/') { + if (strstr(file, "/../")) + return -ENOENT; return snd_input_stdio_open(inputp, file, "r"); + } /* search file in user specified include paths. These directories * are subdirectories of /usr/share/alsa. -- 2.52.0