diff options
| author | Jeff Layton <jlayton@redhat.com> | 2010-01-26 08:45:58 -0500 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2010-05-06 14:14:22 +0200 |
| commit | 42f5c0ad79c1122e1fef2875f2e0a277bf86e97b (patch) | |
| tree | 88a3b86b4cf32578c251f87e552eaec154a1acf8 | |
| parent | d650c6369212851fc9c780c8f800184f48abc348 (diff) | |
| download | samba-42f5c0ad79c1122e1fef2875f2e0a277bf86e97b.tar.gz | |
mount.cifs: check for invalid characters in device name and mountpoint
It's apparently possible to corrupt the mtab if you pass embedded
newlines to addmntent. Apparently tabs are also a problem with certain
earlier glibc versions. Backslashes are also a minor issue apparently,
but we can't reasonably filter those.
Make sure that neither the devname or mountpoint contain any problematic
characters before allowing the mount to proceed.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
(cherry picked from commit 5532a5d5cf7cec0bb758a80e9ee74b5807088661)
| -rw-r--r-- | source3/client/mount.cifs.c | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/source3/client/mount.cifs.c b/source3/client/mount.cifs.c index 4d8162c501a..1722eb033a1 100644 --- a/source3/client/mount.cifs.c +++ b/source3/client/mount.cifs.c @@ -1194,6 +1194,36 @@ static void print_cifs_mount_version(void) MOUNT_CIFS_VENDOR_SUFFIX); } +/* + * This function borrowed from fuse-utils... + * + * glibc's addmntent (at least as of 2.10 or so) doesn't properly encode + * newlines embedded within the text fields. To make sure no one corrupts + * the mtab, fail the mount if there are embedded newlines. + */ +static int check_newline(const char *progname, const char *name) +{ + char *s; + for (s = "\n"; *s; s++) { + if (strchr(name, *s)) { + fprintf(stderr, "%s: illegal character 0x%02x in mount entry\n", + progname, *s); + return EX_USAGE; + } + } + return 0; +} + +static int check_mtab(const char *progname, const char *devname, + const char *dir) +{ + if (check_newline(progname, devname) == -1 || + check_newline(progname, dir) == -1) + return EX_USAGE; + return 0; +} + + int main(int argc, char ** argv) { int c; @@ -1640,6 +1670,10 @@ mount_retry: if (verboseflag) fprintf(stderr, "\n"); + rc = check_mtab(thisprogram, dev_name, mountpoint); + if (rc) + goto mount_exit; + if (!fakemnt && mount(dev_name, ".", "cifs", flags, options)) { switch (errno) { case ECONNREFUSED: |