diff options
| author | Jeff Layton <jlayton@redhat.com> | 2010-01-26 08:36:03 -0500 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2010-03-29 09:41:00 +0200 |
| commit | ed18be92ed14de689b6493d534e65dfa3855fbc2 (patch) | |
| tree | e1e0e884343f657b24aaff070aa4bc4635fa25c7 /client | |
| parent | a395811b01e1ee40198749e45eeaf56d0093a7b6 (diff) | |
| download | samba-ed18be92ed14de689b6493d534e65dfa3855fbc2.tar.gz | |
mount.cifs: check for invalid characters in device name and mountpoint
It's apparently possible to corrupt the mtab if you pass embedded
newlines to addmntent. Apparently tabs are also a problem with certain
earlier glibc versions. Backslashes are also a minor issue apparently,
but we can't reasonably filter those.
Make sure that neither the devname or mountpoint contain any problematic
characters before allowing the mount to proceed.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
(cherry picked from commit ae24005a5a2c165dfd9b859bf1c02b5f7e967be5)
Diffstat (limited to 'client')
| -rw-r--r-- | client/mount.cifs.c | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/client/mount.cifs.c b/client/mount.cifs.c index 6adec92b0c5..6662eea48e6 100644 --- a/client/mount.cifs.c +++ b/client/mount.cifs.c @@ -1165,6 +1165,36 @@ static void print_cifs_mount_version(void) MOUNT_CIFS_VENDOR_SUFFIX); } +/* + * This function borrowed from fuse-utils... + * + * glibc's addmntent (at least as of 2.10 or so) doesn't properly encode + * newlines embedded within the text fields. To make sure no one corrupts + * the mtab, fail the mount if there are embedded newlines. + */ +static int check_newline(const char *progname, const char *name) +{ + char *s; + for (s = "\n"; *s; s++) { + if (strchr(name, *s)) { + fprintf(stderr, "%s: illegal character 0x%02x in mount entry\n", + progname, *s); + return EX_USAGE; + } + } + return 0; +} + +static int check_mtab(const char *progname, const char *devname, + const char *dir) +{ + if (check_newline(progname, devname) == -1 || + check_newline(progname, dir) == -1) + return EX_USAGE; + return 0; +} + + int main(int argc, char ** argv) { int c; @@ -1608,6 +1638,10 @@ mount_retry: if (verboseflag) fprintf(stderr, "\n"); + rc = check_mtab(thisprogram, dev_name, mountpoint); + if (rc) + goto mount_exit; + if (!fakemnt && mount(dev_name, ".", "cifs", flags, options)) { switch (errno) { case ECONNREFUSED: |