From 45b53659d30fa443cee97236f93d1c946b048d3d Mon Sep 17 00:00:00 2001 From: eqawasm <86770917+eqawasm@users.noreply.github.com> Date: Wed, 17 May 2023 14:02:25 -0400 Subject: [PATCH] Update unshield.c fix path traversal bug --- src/unshield.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/unshield.c b/src/unshield.c index 0481b872..dbb89b72 100644 --- a/src/unshield.c +++ b/src/unshield.c @@ -493,6 +493,7 @@ static bool extract_file(Unshield* unshield, const char* prefix, int index) /* use GNU extension to return non-existing files to real_output_directory */ realpath(output_directory, real_output_directory); realpath(filename, real_filename); + strncat(real_output_directory, "/", PATH_MAX); if (real_filename == NULL || strncmp(real_filename, real_output_directory, strlen(real_output_directory)) != 0)