Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2024-11-23 05:09:43 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Fix #23657 - Command injection vulnerability via rbin->r2 ##crash

Browse Source
This commit is contained in:
pancake 2024-11-19 09:35:51 +01:00
parent fa964a4782
commit 28b0badd69
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libr/fs/fs.c
View File

@ -140,7 +140,7 @@ R_API RFSRoot* r_fs_mount(RFS* fs, const char* fstype, const char* path, ut64 de
fstype = (const char *)heapFsType;
}
if (!(p = r_fs_plugin_get (fs, fstype))) {
R_LOG_ERROR ("Invalid filesystem type");
R_LOG_ERROR ("Invalid filesystem type '%s'", fstype);
free (heapFsType);
return NULL;
}

2
libr/main/radare2.c
View File

@ -1649,7 +1649,7 @@ R_API int r_main_radare2(int argc, const char **argv) {
}
if (r->bin->cur && r->bin->cur->bo && r->bin->cur->bo->info && r->bin->cur->bo->info->rclass && !strcmp ("fs", r->bin->cur->bo->info->rclass)) {
const char *fstype = r->bin->cur->bo->info->bclass;
r_core_cmdf (r, "m /root %s @ 0", fstype);
r_fs_mount (r->fs, fstype, "/root", 0);
}
r_core_cmd0 (r, "=!"); // initalize io subsystem
mr.iod = r->io ? r_io_desc_get (r->io, mr.fh->fd) : NULL;