Validate partition name when searching for physical partitions.
Bug: 117274137
Test: fastboot getvar has-slot:../by-name/system
Change-Id: Ibc74a12f836a30bdf1fd7f6b2a1e941de2430c70
diff --git a/fastboot/device/utility.cpp b/fastboot/device/utility.cpp
index 528abec..30c5960 100644
--- a/fastboot/device/utility.cpp
+++ b/fastboot/device/utility.cpp
@@ -23,6 +23,7 @@
#include <android-base/file.h>
#include <android-base/logging.h>
+#include <android-base/strings.h>
#include <fs_mgr.h>
#include <fs_mgr_dm_linear.h>
#include <liblp/liblp.h>
@@ -82,6 +83,10 @@
}
std::optional<std::string> FindPhysicalPartition(const std::string& name) {
+ // Check for an invalid file name
+ if (android::base::StartsWith(name, "../") || name.find("/../") != std::string::npos) {
+ return {};
+ }
std::string path = "/dev/block/by-name/" + name;
if (access(path.c_str(), W_OK) < 0) {
return {};