Leahnaya/dolphin
1
0
Fork 0
mirror of https://github.com/dolphin-emu/dolphin.git synced 2026-08-16 23:37:41 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prevent path traversal in NANDImporter::ProcessEntry

Browse Source 
Reported by MrSynAckster. A specifically crafted NAND dump could use
path traversal to overwrite files on the host file system.

This is also an accuracy fix for importing NAND dumps that contain
file names that Dolphin is supposed to escape. Some games' save files
are affected.
This commit is contained in:
JosJuice
2026-05-30 11:28:03 +02:00
parent 3abadcd507
commit 2faa9760d3
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
Source/Core/DiscIO/NANDImporter.cpp
View File

@@ -11,6 +11,7 @@
#include "Common/IOFile.h"
#include "Common/Logging/Log.h"
#include "Common/MsgHandler.h"
#include "Common/NandPaths.h"
#include "Core/IOS/ES/Formats.h"
namespace DiscIO
@@ -134,7 +135,7 @@ bool NANDImporter::ExtractFiles()
std::string NANDImporter::GetPath(const NANDFSTEntry& entry, const std::string& parent_path)
{
std::string name(entry.name, strnlen(entry.name, sizeof(NANDFSTEntry::name)));
return parent_path + '/' + name;
return parent_path + '/' + Common::EscapeFileName(name);
}
bool NANDImporter::ProcessEntry(u16 entry_number, const std::string& parent_path)