diff options
| author |   schwarze <schwarze@openbsd.org> | 2014-07-19 11:35:09 +0000 |
|---|---|---|
| committer | schwarze <schwarze@openbsd.org> | 2014-07-19 11:35:09 +0000 |
| commit | 8147578414af9663e24289e895fc689a48a1de06 (patch) | |
| tree | 4e7bb0f18ed8fd4261515e76cc90b568213e898b /lib/libcrypto/arc4random/getentropy_solaris.c | |
| parent | Document that abort() is async signal safe now that it doesn't flush (diff) | |
| download | wireguard-openbsd-8147578414af9663e24289e895fc689a48a1de06.tar.xz wireguard-openbsd-8147578414af9663e24289e895fc689a48a1de06.zip | |
Security fix:
Validate the name of the file to show before opening it.
Only allow relative filenames starting with "man" or "cat"
and containing neither "/.." nor "../".
While here, correct the condition discarding an initial "./".
Vulnerability found by Sebastien Marie <semarie-openbsd at latrappe dot fr>.
Many thanks for sending a patch; however, i did not use it but made the
checks even stricter.
Diffstat (limited to 'lib/libcrypto/arc4random/getentropy_solaris.c')
0 files changed, 0 insertions, 0 deletions