commit 2d3c39c7ecfe6a34b013102496979a6f02649d4a
author TreeHugger Robot <treehugger-gerrit@google.com> Mon Mar 23 03:10:29 2020 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Mon Mar 23 03:10:29 2020 +0000
tree 42728d14fd57c4c8f686188c1cda63ece586eb96
parent 40e794335b92f2f5237bcfddab454758cc4ad246
parent 6111b2b92a1844f5796c718bf0736102b876c2b9

Merge "MTP: Sanitize filename provided from MTP host" into qt-qpr1-dev

media/mtp/MtpServer.cpp

diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp
index ca8cb78..dd69496 100644
--- a/media/mtp/MtpServer.cpp
+++ b/media/mtp/MtpServer.cpp
@@ -44,6 +44,7 @@
 #include "MtpStringBuffer.h"
 
 namespace android {
+static const int SN_EVENT_LOG_ID = 0x534e4554;
 
 static const MtpOperationCode kSupportedOperationCodes[] = {
     MTP_OPERATION_GET_DEVICE_INFO,
@@ -961,6 +962,17 @@
     if (!parseDateTime(modified, modifiedTime))
         modifiedTime = 0;
 
+    if ((strcmp(name, ".") == 0) || (strcmp(name, "..") == 0) ||
+        (strchr(name, '/') != NULL)) {
+        char errMsg[80];
+
+        snprintf(errMsg, sizeof(errMsg), "Invalid name: %s", (const char *) name);
+        ALOGE("%s (b/130656917)", errMsg);
+        android_errorWriteWithInfoLog(SN_EVENT_LOG_ID, "130656917", -1, errMsg,
+                                      strlen(errMsg));
+
+        return MTP_RESPONSE_INVALID_PARAMETER;
+    }
     if (path[path.size() - 1] != '/')
         path.append("/");
     path.append(name);