Skip to content

Commit c4c0e8b

Browse files
rouaultrouault
committed
/vsis3/: fix out of bounds introduced by 605a79d
Fixes https://issues.oss-fuzz.com/issues/493485122
1 parent 5cc4812 commit c4c0e8b

File tree

2 files changed

+97
-1
lines changed

2 files changed

+97
-1
lines changed

‎autotest/gcore/vsis3.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7218,3 +7218,41 @@ def test_vsis3_credential_process_missing_fields(tmp_vsimem, aws_test_config):
72187218

72197219
finally:
72207220
os.unlink(script_path)
7221+
7222+
7223+
###############################################################################
7224+
# Test invalid filenames
7225+
7226+
7227+
@gdaltest.enable_exceptions()
7228+
def test_vsis3_invalid_filenames():
7229+
7230+
with pytest.raises(Exception, match="Invalid filename"):
7231+
gdal.VSIFile("/vsis3/../traversal", "rb")
7232+
7233+
with pytest.raises(Exception, match="Invalid filename"):
7234+
gdal.VSIStatL("/vsis3/../traversal")
7235+
7236+
with pytest.raises(Exception, match="Invalid filename"):
7237+
gdal.Mkdir("/vsis3/../traversal", 0)
7238+
7239+
with pytest.raises(Exception, match="Invalid filename"):
7240+
gdal.Rmdir("/vsis3/../traversal")
7241+
7242+
with pytest.raises(Exception, match="Invalid filename"):
7243+
gdal.Unlink("/vsis3/../traversal")
7244+
7245+
with pytest.raises(Exception, match="Invalid filename"):
7246+
gdal.GetFileMetadata("/vsis3/../traversal", "HEADERS")
7247+
7248+
with pytest.raises(Exception, match="Invalid filename"):
7249+
gdal.SetFileMetadata("/vsis3/../traversal", {"foo": "bar"}, "HEADERS")
7250+
7251+
with pytest.raises(Exception, match="Invalid filename"):
7252+
gdal.Rename("/vsis3/../traversal", "/vsis3/valid")
7253+
7254+
with pytest.raises(Exception, match="Invalid filename"):
7255+
gdal.Rename("/vsis3/valid", "/vsis3/../traversal")
7256+
7257+
with pytest.raises(Exception, match="Invalid filename"):
7258+
gdal.OpenDir("/vsis3/../traversal")

‎port/cpl_vsil_s3.cpp‎

Lines changed: 59 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1933,6 +1933,12 @@ VSIVirtualHandleUniquePtr VSICurlFilesystemHandlerBaseWritable::Open(
19331933

19341934
CPLString osFilename(pszFilename);
19351935
NormalizeFilenameIfNeeded(osFilename);
1936+
if (!STARTS_WITH_CI(osFilename.c_str(), GetFSPrefix().c_str()))
1937+
{
1938+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'",
1939+
pszFilename);
1940+
return nullptr;
1941+
}
19361942

19371943
if (strchr(pszAccess, '+'))
19381944
{
@@ -2463,6 +2469,12 @@ char **VSIS3FSHandler::GetFileMetadata(const char *pszFilename,
24632469

24642470
CPLString osFilename(pszFilename);
24652471
NormalizeFilenameIfNeeded(osFilename);
2472+
if (!STARTS_WITH_CI(osFilename.c_str(), GetFSPrefix().c_str()))
2473+
{
2474+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'",
2475+
pszFilename);
2476+
return nullptr;
2477+
}
24662478

24672479
if (pszDomain == nullptr || !EQUAL(pszDomain, "TAGS"))
24682480
{
@@ -2585,6 +2597,12 @@ bool VSIS3FSHandler::SetFileMetadata(const char *pszFilename,
25852597

25862598
CPLString osFilename(pszFilename);
25872599
NormalizeFilenameIfNeeded(osFilename);
2600+
if (!STARTS_WITH_CI(osFilename.c_str(), GetFSPrefix().c_str()))
2601+
{
2602+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'",
2603+
pszFilename);
2604+
return false;
2605+
}
25882606

25892607
if (pszDomain == nullptr ||
25902608
!(EQUAL(pszDomain, "HEADERS") || EQUAL(pszDomain, "TAGS")))
@@ -2772,6 +2790,13 @@ int IVSIS3LikeFSHandler::MkdirInternal(const char *pszDirname, long /*nMode*/,
27722790

27732791
CPLString osDirname(pszDirname);
27742792
NormalizeFilenameIfNeeded(osDirname);
2793+
if (!STARTS_WITH_CI(osDirname.c_str(), GetFSPrefix().c_str()))
2794+
{
2795+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'",
2796+
pszDirname);
2797+
return -1;
2798+
}
2799+
27752800
if (!osDirname.empty() && osDirname.back() != '/')
27762801
osDirname += "/";
27772802

@@ -2846,6 +2871,13 @@ int IVSIS3LikeFSHandler::Rmdir(const char *pszDirname)
28462871

28472872
CPLString osDirname(pszDirname);
28482873
NormalizeFilenameIfNeeded(osDirname);
2874+
if (!STARTS_WITH_CI(osDirname.c_str(), GetFSPrefix().c_str()))
2875+
{
2876+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'",
2877+
pszDirname);
2878+
return -1;
2879+
}
2880+
28492881
if (!osDirname.empty() && osDirname.back() != '/')
28502882
osDirname += "/";
28512883

@@ -2905,6 +2937,12 @@ int IVSIS3LikeFSHandler::Stat(const char *pszFilename, VSIStatBufL *pStatBuf,
29052937

29062938
CPLString osFilename(pszFilename);
29072939
NormalizeFilenameIfNeeded(osFilename);
2940+
if (!STARTS_WITH_CI(osFilename.c_str(), GetFSPrefix().c_str()))
2941+
{
2942+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'",
2943+
pszFilename);
2944+
return -1;
2945+
}
29082946

29092947
if ((nFlags & VSI_STAT_CACHE_ONLY) != 0)
29102948
return VSICurlFilesystemHandlerBase::Stat(osFilename, pStatBuf, nFlags);
@@ -3054,6 +3092,12 @@ int IVSIS3LikeFSHandler::Unlink(const char *pszFilename)
30543092

30553093
CPLString osFilename(pszFilename);
30563094
NormalizeFilenameIfNeeded(osFilename);
3095+
if (!STARTS_WITH_CI(osFilename.c_str(), GetFSPrefix().c_str()))
3096+
{
3097+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'",
3098+
pszFilename);
3099+
return -1;
3100+
}
30573101

30583102
std::string osNameWithoutPrefix = osFilename.c_str() + GetFSPrefix().size();
30593103
if (osNameWithoutPrefix.find('/') == std::string::npos)
@@ -3098,10 +3142,19 @@ int IVSIS3LikeFSHandler::Rename(const char *oldpath, const char *newpath,
30983142

30993143
CPLString osOldPath(oldpath);
31003144
NormalizeFilenameIfNeeded(osOldPath);
3145+
if (!STARTS_WITH_CI(osOldPath.c_str(), GetFSPrefix().c_str()))
3146+
{
3147+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'", oldpath);
3148+
return -1;
3149+
}
31013150

31023151
CPLString osNewPath(newpath);
31033152
NormalizeFilenameIfNeeded(osNewPath);
3104-
3153+
if (!STARTS_WITH_CI(osNewPath.c_str(), GetFSPrefix().c_str()))
3154+
{
3155+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'", newpath);
3156+
return -1;
3157+
}
31053158
NetworkStatisticsFileSystem oContextFS(GetFSPrefix().c_str());
31063159
NetworkStatisticsAction oContextAction("Rename");
31073160

@@ -3468,6 +3521,11 @@ VSIDIR *IVSIS3LikeFSHandler::OpenDir(const char *pszPath, int nRecurseDepth,
34683521

34693522
CPLString osPath(pszPath);
34703523
NormalizeFilenameIfNeeded(osPath);
3524+
if (!STARTS_WITH_CI(osPath.c_str(), GetFSPrefix().c_str()))
3525+
{
3526+
CPLError(CE_Failure, CPLE_AppDefined, "Invalid filename '%s'", pszPath);
3527+
return nullptr;
3528+
}
34713529

34723530
NetworkStatisticsFileSystem oContextFS(GetFSPrefix().c_str());
34733531
NetworkStatisticsAction oContextAction("OpenDir");

0 commit comments

Comments
 (0)