do not allow relative path names to be added to the pathvec

CVE-2009-0115 taught us that such paths should not be tolerated

Signed-off-by: Mike Snitzer <snitzer@redhat.com>

diff --git a/multipathd/main.c b/multipathd/main.c
index f2848fb..c7ef4df 100644 (file)
--- a/multipathd/main.c
+++ b/multipathd/main.c
@@ -353,6 +353,14 @@ ev_add_path (char * devname, struct vectors * vecs)
        struct path * pp;
        char empty_buff[WWID_SIZE] = {0};
 
+       if (strstr(devname, "..") != NULL) {
+               /*
+                * Don't allow relative device names in the pathvec
+                */
+               condlog(0, "%s: path name is invalid", devname);
+               return 1;
+       }
+
        pp = find_path_by_dev(vecs->pathvec, devname);
 
        if (pp) {