From 2faa9760d3e689ceb5b92f71e29a4a869b9f50f9 Mon Sep 17 00:00:00 2001 From: JosJuice Date: Sat, 30 May 2026 11:28:03 +0200 Subject: [PATCH] Prevent path traversal in NANDImporter::ProcessEntry Reported by MrSynAckster. A specifically crafted NAND dump could use path traversal to overwrite files on the host file system. This is also an accuracy fix for importing NAND dumps that contain file names that Dolphin is supposed to escape. Some games' save files are affected. --- Source/Core/DiscIO/NANDImporter.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Source/Core/DiscIO/NANDImporter.cpp b/Source/Core/DiscIO/NANDImporter.cpp index 77492fd0f0..4477621984 100644 --- a/Source/Core/DiscIO/NANDImporter.cpp +++ b/Source/Core/DiscIO/NANDImporter.cpp @@ -11,6 +11,7 @@ #include "Common/IOFile.h" #include "Common/Logging/Log.h" #include "Common/MsgHandler.h" +#include "Common/NandPaths.h" #include "Core/IOS/ES/Formats.h" namespace DiscIO @@ -134,7 +135,7 @@ bool NANDImporter::ExtractFiles() std::string NANDImporter::GetPath(const NANDFSTEntry& entry, const std::string& parent_path) { std::string name(entry.name, strnlen(entry.name, sizeof(NANDFSTEntry::name))); - return parent_path + '/' + name; + return parent_path + '/' + Common::EscapeFileName(name); } bool NANDImporter::ProcessEntry(u16 entry_number, const std::string& parent_path)