From 38b317a74b84fb45acb8891e518dee0a87435505 Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Wed, 15 Feb 2023 15:39:45 +0100 Subject: prog: reject escaping filenames during deserialization We already try as hard as possible to not generate escaping (global) filenames. However, it's possible we read them from the corpus if it happens to contain some. Also check for escaping filenames during deserialization. Fixes #3678 --- prog/encoding_test.go | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'prog/encoding_test.go') diff --git a/prog/encoding_test.go b/prog/encoding_test.go index 73c2cabcc..e99663aa3 100644 --- a/prog/encoding_test.go +++ b/prog/encoding_test.go @@ -335,6 +335,13 @@ func TestDeserialize(t *testing.T) { In: `test$str2(&(0x7f0000000000)="$eJwqrqzKTszJSS0CBAAA//8TyQPi`, Err: `want ", got EOF`, }, + { + In: `mutate9(&(0x7f0000000000)='./local/filename\x00')`, + }, + { + In: `mutate9(&(0x7f0000000000)='/escaping/filename\x00')`, + Err: `escaping filename`, + }, }) } -- cgit mrf-deployment