diff options
| author | Jeremy <jeremy@sturgix.com> | 2015-12-01 15:41:03 -0500 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2016-02-16 11:21:45 -0500 |
| commit | 4e19133dccfc4d252e9ed2695f6fe49bb4503ac8 (patch) | |
| tree | 73fb555d13ed42f8283aaea33eb62eb9fed8ced4 /src/common | |
| parent | b3639c8291098eeeefb166914bad98a53e506b90 (diff) | |
| download | tor-4e19133dccfc4d252e9ed2695f6fe49bb4503ac8.tar.gz tor-4e19133dccfc4d252e9ed2695f6fe49bb4503ac8.zip | |
src/common/util.c:expand_filename() - Perhaps use GetFullPathName() as a form of input validation on the filename argument.
Diffstat (limited to 'src/common')
| -rw-r--r-- | src/common/util.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/common/util.c b/src/common/util.c index b33c80fd45..e8044f9089 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -2873,6 +2873,9 @@ expand_filename(const char *filename) { tor_assert(filename); #ifdef _WIN32 + /* Might consider using GetFullPathName() as described here: + * http://etutorials.org/Programming/secure+programming/Chapter+3.+Input+Validation/3.7+Validating+Filenames+and+Paths/ + */ return tor_strdup(filename); #else if (*filename == '~') { |