added checking for invalid/malicious filenames in network protocol

[rocksndiamonds.git] / src / network.c

diff --git a/src/network.c b/src/network.c
index d780e0d548ecb0755171fd599fb670cd95652629..d0c156198408b3af688b3f106119b9a9280af3b0 100644 (file)
--- a/src/network.c
+++ b/src/network.c
@@ -182,6 +182,11 @@ char *getNetworkPlayerName(int player_nr)
   return(EMPTY_PLAYER_NAME);
 }
 
+static boolean hasPathSeparator(char *s)
+{
+  return (strchr(s, '/') != NULL);
+}
+
 static void StartNetworkServer(int port)
 {
   static int p;
@@ -694,6 +699,8 @@ static void Handle_OP_START_PLAYING()
     level_nr = new_level_nr;
   }
 
+  SetLevelSetInfo(new_leveldir_identifier, new_level_nr);
+
   /* needed if level set of network game changed graphics, sounds or music */
   ReloadCustomArtwork(0);
 
@@ -824,6 +831,12 @@ static void Handle_OP_LEVEL_FILE()
   printf("OP_LEVEL_FILE: %d\n", player_nr);
 
   leveldir_identifier = getStringCopy(getNetworkBufferString(read_buffer));
+
+  if (hasPathSeparator(leveldir_identifier))
+    Error(ERR_EXIT, "protocol error: invalid filename from network client");
+
+  InitNetworkLevelDirectory(leveldir_identifier);
+
   network_level_dir   = getNetworkLevelDir(leveldir_identifier);
 
   file_info->nr       = getNetworkBuffer16BitInteger(read_buffer);
@@ -832,7 +845,8 @@ static void Handle_OP_LEVEL_FILE()
   file_info->basename = getStringCopy(getNetworkBufferString(read_buffer));
   file_info->filename = getPath2(network_level_dir, file_info->basename);
 
-  InitNetworkLevelDirectory(leveldir_identifier);
+  if (hasPathSeparator(file_info->basename))
+    Error(ERR_EXIT, "protocol error: invalid filename from network client");
 
   getNetworkBufferFile(read_buffer, file_info->filename);
 
@@ -844,6 +858,9 @@ static void Handle_OP_LEVEL_FILE()
     tmpl_info->basename = getStringCopy(getNetworkBufferString(read_buffer));
     tmpl_info->filename = getPath2(network_level_dir, tmpl_info->basename);
 
+    if (hasPathSeparator(tmpl_info->basename))
+      Error(ERR_EXIT, "protocol error: invalid filename from network client");
+
     getNetworkBufferFile(read_buffer, tmpl_info->filename);
   }