Re: pkg/55684 (Absolute & relative directory traversal with archivers/zoo)

[Joerg Sonnenberger <joerg%bec.de@localhost>]

On Sun, Oct 04, 2020 at 10:40:01AM +0000, Martin Husemann wrote:
>  +   /* remove all "../" inside filename */
>  +   while ((p = strstr( fname, "../" )) != NULL) {
>  +      l = strlen(p+3);
>  +      if (l == 0)
>  +        *p = 0;
>  +      else
>  +         memmove(p, p+3, l);
>  +   }

This doesn't seem to be correct. It should remove "../" from the start
of the path and "/../" anywhere else. foo../ is a valid path name.

Joerg