On 22 August 2016 at 16:02, Michael S. Tsirkin wrote:
> On Mon, Aug 22, 2016 at 10:23:19AM +0100, Peter Maydell wrote:
>> On 19 August 2016 at 18:30, Greg Kurz wrote:
>> > Maybe the check can even be made in the top layer then. I should spend
>> > more time to see which is best.
>> >
>> > My main
On Mon, Aug 22, 2016 at 10:23:19AM +0100, Peter Maydell wrote:
> On 19 August 2016 at 18:30, Greg Kurz wrote:
> > Maybe the check can even be made in the top layer then. I should spend
> > more time to see which is best.
> >
> > My main concern now is that, unlike I said on IRC, I'm afraid I won't
On Fri, Aug 19, 2016 at 06:03:29PM +0100, Peter Maydell wrote:
> On 19 August 2016 at 17:37, Greg Kurz wrote:
> > Peter Maydell wrote:
> >> If (1) is true and "only single path component" is a protocol
> >> requirement then probably we should be enforcing this at a
> >> higher layer than in 9p-lo
Hello Peter, all
+-- On Mon, 22 Aug 2016, Peter Maydell wrote --+
| Opinions welcome on whether we need to hold 2.7 for this bug.
I'm going through the VirtFS details to figure out a best fix for this
issue. Nonetheless, IMO we need not hold 2.7 release for this bug.
Thank you.
--
Prasad J
On 19 August 2016 at 18:30, Greg Kurz wrote:
> Maybe the check can even be made in the top layer then. I should spend
> more time to see which is best.
>
> My main concern now is that, unlike I said on IRC, I'm afraid I won't be
> able to work on this before next Wednesday... :-\
>
> Hope it is no
On Fri, 19 Aug 2016 18:03:29 +0100
Peter Maydell wrote:
> On 19 August 2016 at 17:37, Greg Kurz wrote:
> > Peter Maydell wrote:
> >> If (1) is true and "only single path component" is a protocol
> >> requirement then probably we should be enforcing this at a
> >> higher layer than in 9p-local
On 19 August 2016 at 17:37, Greg Kurz wrote:
> Peter Maydell wrote:
>> If (1) is true and "only single path component" is a protocol
>> requirement then probably we should be enforcing this at a
>> higher layer than in 9p-local.c, ie in hw/9pfs/cofs.c.
> As we discussed on IRC, the / character i
On Fri, 19 Aug 2016 16:14:48 +0100
Peter Maydell wrote:
> On 19 August 2016 at 15:55, Peter Maydell wrote:
> > Also, strstr(name, "../") is the wrong check. There are I think
> > two possibilities here:
> >
> > (1) the "name" parameter may only validly be a single pathname
> > component. In this
On Fri, 19 Aug 2016 15:55:17 +0100
Peter Maydell wrote:
> On 11 August 2016 at 06:13, P J P wrote:
> > From: Prasad J Pandit
> >
> > At various places in 9pfs back-end, it creates full path by
> > concatenating two path strings. It could lead to a path
> > traversal issue if one of the paramete
On 19 August 2016 at 15:55, Peter Maydell wrote:
> Also, strstr(name, "../") is the wrong check. There are I think
> two possibilities here:
>
> (1) the "name" parameter may only validly be a single pathname
> component. In this case we should be enforcing this by treating
> any string with a "/"
On 11 August 2016 at 06:13, P J P wrote:
> From: Prasad J Pandit
>
> At various places in 9pfs back-end, it creates full path by
> concatenating two path strings. It could lead to a path
> traversal issue if one of the parameter was a relative path.
> Add check to avoid it.
>
> Reported-by: Felix
On Thu, 11 Aug 2016 10:43:11 +0530
P J P wrote:
> From: Prasad J Pandit
>
> At various places in 9pfs back-end, it creates full path by
> concatenating two path strings. It could lead to a path
> traversal issue if one of the parameter was a relative path.
> Add check to avoid it.
>
> Reported
On Thu, 11 Aug 2016 14:27:15 +0800
Fam Zheng wrote:
> On Wed, 08/10 23:17, no-re...@ec2-52-6-146-230.compute-1.amazonaws.com wrote:
> > Hi,
> >
> > Your series failed automatic build test. Please find the testing commands
> > and
> > their output below. If you have docker installed, you can pro
On Thu, 11 Aug 2016 12:01:46 +0530
"Aneesh Kumar K.V" wrote:
> P J P writes:
>
> > From: Prasad J Pandit
> >
> > At various places in 9pfs back-end, it creates full path by
> > concatenating two path strings. It could lead to a path
> > traversal issue if one of the parameter was a relative pa
On Wed, 08/10 23:17, no-re...@ec2-52-6-146-230.compute-1.amazonaws.com wrote:
> Hi,
>
> Your series failed automatic build test. Please find the testing commands and
> their output below. If you have docker installed, you can probably reproduce
> it
> locally.
This may not relate to this patch.
P J P writes:
> From: Prasad J Pandit
>
> At various places in 9pfs back-end, it creates full path by
> concatenating two path strings. It could lead to a path
> traversal issue if one of the parameter was a relative path.
> Add check to avoid it.
>
> Reported-by: Felix Wilhelm
> Signed-off-by:
Hi,
Your series failed automatic build test. Please find the testing commands and
their output below. If you have docker installed, you can probably reproduce it
locally.
Subject: [Qemu-devel] [PATCH] 9pfs: add check for relative path
Message-id: 1470892391-4917-1-git-send-email-ppan...@redhat.co
17 matches
Mail list logo
