MTP: Sanitize filename provided from MTP host#3
Fix string handling on file name
Bug: 130656917
Test: atest frameworks/av/media/mtp/tests
Test: Manual test: modified libmtp for long path traversal attack
Test: Manual test: normal recursive folder copy
Change-Id: Ic6cf2af860f2c5e40fd176b5f4c6d0edfac79b49
diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp
index fdf51b1..8677b90 100644
--- a/media/mtp/MtpServer.cpp
+++ b/media/mtp/MtpServer.cpp
@@ -969,7 +969,7 @@
modifiedTime = 0;
if ((strcmp(name, ".") == 0) || (strcmp(name, "..") == 0) ||
- (strcmp(name, "/") == 0) || (strcmp(basename(name), name) != 0)) {
+ (strchr(name, '/') != NULL)) {
char errMsg[80];
snprintf(errMsg, sizeof(errMsg), "Invalid name: %s", (const char *) name);
@@ -981,7 +981,7 @@
}
if (path[path.size() - 1] != '/')
path.append("/");
- path.append(basename(name));
+ path.append(name);
// check space first
if (mSendObjectFileSize > storage->getFreeSpace())