Merge pull request #1084 from libgit2/filename-validation

Filename validation

1 files changed, 6 insertions, 1 deletions

diff --git a/src/tree.c b/src/tree.c
index 7b47af347..6f9838880 100644
--- a/src/tree.c
+++ b/src/tree.c
@@ -26,7 +26,9 @@ static bool valid_filemode(const int filemode)
 
 static int valid_entry_name(const char *filename)
 {
-	return *filename != '\0' && strchr(filename, '/') == NULL;
+	return *filename != '\0' && strchr(filename, '/') == NULL &&
+		strcmp(filename, "..") != 0 && strcmp(filename, ".") != 0 &&
+		strcmp(filename, ".git") != 0;
 }
 
 static int entry_sort_cmp(const void *a, const void *b)
@@ -372,6 +374,9 @@ static int append_entry(
 {
 	git_tree_entry *entry;
 
+	if (!valid_entry_name(filename))
+		return tree_error("Failed to insert entry. Invalid name for a tree entry");
+
 	entry = alloc_entry(filename);
 	GITERR_CHECK_ALLOC(entry);