commit e783e4b24b9e4080e50c50d62a24bcbfabb3e03d
author James Wei <jameswei@google.com> Tue May 28 17:18:21 2019 +0800
committer James Wei <jameswei@google.com> Thu May 30 22:36:27 2019 +0800
tree 06c7e3e2e47002e6e9ee6c99e2597606b8d706d2
parent 8b43461ccef647345a49d65698c7e03c50e78e3b

MTP: Sanitize filename provided from MTP host

Fix potential security vulnerability via MTP path traversal

Bug: 130656917
Test: atest frameworks/av/media/mtp/tests
Test: Manual test: modified libmtp for path traversal attack
Test: Manual test: normal recursive folder copy
Change-Id: I467e1e6a76d09951050f7f45e5a63419e540c572

media/mtp/MtpServer.cpp

diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp
index ca8cb78..6160c3c 100644
--- a/media/mtp/MtpServer.cpp
+++ b/media/mtp/MtpServer.cpp
@@ -44,6 +44,7 @@
 #include "MtpStringBuffer.h"
 
 namespace android {
+static const int SN_EVENT_LOG_ID = 0x534e4554;
 
 static const MtpOperationCode kSupportedOperationCodes[] = {
     MTP_OPERATION_GET_DEVICE_INFO,
@@ -961,9 +962,20 @@
     if (!parseDateTime(modified, modifiedTime))
         modifiedTime = 0;
 
+    if ((strcmp(name, ".") == 0) || (strcmp(name, "..") == 0) ||
+        (strcmp(name, "/") == 0) || (strcmp(basename(name), name) != 0)) {
+        char errMsg[80];
+
+        sprintf(errMsg, "Invalid name: %s", (const char *) name);
+        ALOGE("%s (b/130656917)", errMsg);
+        android_errorWriteWithInfoLog(SN_EVENT_LOG_ID, "130656917", -1, errMsg,
+                                      strlen(errMsg));
+
+        return MTP_RESPONSE_INVALID_PARAMETER;
+    }
     if (path[path.size() - 1] != '/')
         path.append("/");
-    path.append(name);
+    path.append(basename(name));
 
     // check space first
     if (mSendObjectFileSize > storage->getFreeSpace())