Re: radvd 1.8.2 released with security fixes

[John Haxby <john.haxby () oracle com>]

On 07/10/11 14:03, Robert Święcki wrote:
> On Fri, Oct 7, 2011 at 12:35 PM, Huzaifa Sidhpurwala
> <huzaifas () redhat com> wrote:
> > Shouldnt this be:
> >
> >        /* No path traversal */
> >        if (strstr(iface, "..") || strchr(iface, '/'))
> >                return -1;
> FWIW, this will reject too much;
>
> /path/to/sth..jpg

Indeed, since I don't believe that iface can reasonably include a "/"
its sufficient to check for that.   If not then you need to check for
"../" at the beginning of iface and "/.." anywhere else in it.   But
simply forbidding "/" should be fine.

jch