44 lines
1.6 KiB
Diff
44 lines
1.6 KiB
Diff
diff --git a/base/gpmisc.c b/base/gpmisc.c
|
|
index c4a69b0..b0d5c71 100644
|
|
--- a/base/gpmisc.c
|
|
+++ b/base/gpmisc.c
|
|
@@ -1090,6 +1090,27 @@ gp_validate_path_len(const gs_memory_t *mem,
|
|
rlen = len;
|
|
}
|
|
else {
|
|
+ char *test = (char *)path, *test1;
|
|
+ uint tlen = len, slen;
|
|
+
|
|
+ /* Look for any pipe (%pipe% or '|' specifications between path separators
|
|
+ * Reject any path spec which has a %pipe% or '|' anywhere except at the start.
|
|
+ */
|
|
+ while (tlen > 0) {
|
|
+ if (test[0] == '|' || (tlen > 5 && memcmp(test, "%pipe", 5) == 0)) {
|
|
+ code = gs_note_error(gs_error_invalidfileaccess);
|
|
+ goto exit;
|
|
+ }
|
|
+ test1 = test;
|
|
+ slen = search_separator((const char **)&test, path + len, test1, 1);
|
|
+ if(slen == 0)
|
|
+ break;
|
|
+ test += slen;
|
|
+ tlen -= test - test1;
|
|
+ if (test >= path + len)
|
|
+ break;
|
|
+ }
|
|
+
|
|
rlen = len+1;
|
|
bufferfull = (char *)gs_alloc_bytes(mem->thread_safe_memory, rlen + prefix_len, "gp_validate_path");
|
|
if (bufferfull == NULL)
|
|
@@ -1164,8 +1185,8 @@ gp_validate_path_len(const gs_memory_t *mem,
|
|
|
|
continue;
|
|
}
|
|
- else if (code < 0 && cdirstrl > 0 && prefix_len == 0 && buffer == bufferfull) {
|
|
- buffer = bufferfull + cdirstrl + dirsepstrl;
|
|
+ else if (code < 0 && cdirstrl > 0 && prefix_len == 0 && buffer == bufferfull
|
|
+ && memcmp(buffer, cdirstr, cdirstrl) && !memcmp(buffer + cdirstrl, dirsepstr, dirsepstrl)) {
|
|
continue;
|
|
}
|
|
break;
|