Re: [PATCH 038/104] virtiofsd: validate path components

[Daniel P . Berrangé]

On Thu, Dec 12, 2019 at 04:37:58PM +0000, Dr. David Alan Gilbert (git) wrote:
> From: Stefan Hajnoczi <address@hidden>
> 
> Several FUSE requests contain single path components.  A correct FUSE
> client sends well-formed path components but there is currently no input
> validation in case something went wrong or the client is malicious.
> 
> Refuse ".", "..", and paths containing '/' when we expect a path
> component.
> 
> Signed-off-by: Stefan Hajnoczi <address@hidden>
> ---
>  tools/virtiofsd/passthrough_ll.c | 59 ++++++++++++++++++++++++++++----
>  1 file changed, 53 insertions(+), 6 deletions(-)

Reviewed-by: Daniel P. Berrangé <address@hidden>


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|