okseby/Quake-III-Arena
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix fs_game '..' reading outside of home and base path

Browse source 
VMs could set fs_game to '..' at anytime to access files outside of home
and base path. fs_game sent by server to clients could also be '..' to
access files outside of home and base path.

'..' was not caught by FS_CheckDirTraversal() as it expects filenames
not a single directory.

I've made fs_game be latched to prevent VMs from changing it with no
good way to validate it before it's used. com_basegame and fs_basegame
are now latched as well.

Additionally, it's now possible to change com_basegame while the engine
is running. game_restart or vid_restart will make it take affect.
com_homepath is now CVAR_PROTECTED to prevent VMs from changing it
to a directory traversal.

This requires my two previous commits for preventing VMs from changing
engine latch cvars and only Cvar_Get fs_game in FS_Startup (so CVAR_INIT
isn't added in serveral other places).

Reported by Noah Metzger (Chomenor).
This commit is contained in:
Zack Middleton 2018-01-21 04:27:55 -06:00
parent 78ca670d4f
commit 3638f69dff
5 changed files with 54 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

4
code/client/cl_main.c
View file

@ -1245,7 +1245,7 @@ void CL_ClearMemory(qboolean shutdownRef)
CL_ShutdownAll(shutdownRef);
// if not running a server clear the whole hunk
if ( !com_sv_running->integer ) {
if ( !com_sv_running || !com_sv_running->integer ) {
// clear the whole hunk
Hunk_Clear();
// clear collision map data
@ -1361,7 +1361,7 @@ static void CL_OldGame(void)
{
// change back to previous fs_game
cl_oldGameSet = qfalse;
Cvar_Set2("fs_game", cl_oldGame, qtrue);
Cvar_Set("fs_game", cl_oldGame);
FS_ConditionalRestart(clc.checksumFeed, qfalse);
}
}