One (hopefully) last change to the sanitize_path() code.

1 files changed, 14 insertions, 17 deletions

diff --git a/util.c b/util.c
index 5243c746..a2e8660b 100644
--- a/util.c
+++ b/util.c
@@ -781,25 +781,22 @@ char *sanitize_path(char *dest, const char *p, const char *rootdir, int depth)
 		}
 		if (*p == '.' && p[1] == '.' && (p[2] == '/' || p[2] == '\0')) {
 			/* ".." component followed by slash or end */
-			if (depth > 0 && sanp == start) {
-				/* allow depth levels of .. at the beginning */
-				--depth;
-				*sanp++ = *p++;
-				*sanp++ = *p++;
-				/* move virtual beginning to leave .. alone */
-				start = sanp;
-				continue;
-			}
-			p += 2;
-			if (sanp != start) {
-				/* back up sanp one level */
-				--sanp; /* now pointing at slash */
-				while (sanp > start && sanp[-1] != '/') {
-					/* skip back up to slash */
-					sanp--;
+			if (depth <= 0 || sanp != start) {
+				p += 2;
+				if (sanp != start) {
+					/* back up sanp one level */
+					--sanp; /* now pointing at slash */
+					while (sanp > start && sanp[-1] != '/') {
+						/* skip back up to slash */
+						sanp--;
+					}
 				}
+				continue;
 			}
-			continue;
+			/* allow depth levels of .. at the beginning */
+			depth--;
+			/* move the virtual beginning to leave the .. alone */
+			start = sanp + 3;
 		}
 		/* copy one component through next slash */
 		while (*p && (*sanp++ = *p++) != '/') {}