Jann Horn d0fb7bb687 Fix r_sandbox_check_path – there were ways to perform directory traversal. ...

- The function failed to catch the case that the path ends with "..",
   allowing the contents of the directory one path component above the
   cwd to be listed. This is probably not very interesting.
 - The function did not check for ".." components in the path if it
   starts with R2_WWWROOT, leading to full directory traversal (example:
   /usr/local/share/radare2/0.9.8.git/www/../../../../../../etc/passwd
 - Use strncmp instead of memcmp
 - Handle relative webroot paths properly
 - Check for empty R2_WWWROOT

2014-03-27 00:32:43 +01:00

..

regex

Some more cleanup and rmeta fixes

2014-01-23 04:00:01 +01:00

t

Purge all r_lib references

2014-02-20 22:16:23 +01:00

alloca.c

…

alloca.s

…

base64.c

Update sdb from git and sync base64 fixes

2014-03-26 23:17:40 +01:00

base85.c

Add cfg.sandbox functionality

2012-10-20 00:31:18 +02:00

big-gmp.c

…

big-ssl.c

…

big.c

…

bitmap.c

Better http support and handle asm.offset in 'px'.

2013-01-04 10:16:41 +01:00

btree.c

Fix some bugs reported by clang-analyzer

2013-02-08 11:42:46 +01:00

buf.c

RCore yank_buf is now a RBuffer with a defined API. Tweaked RBuffer so it reallocs buffers correctly. Modified io_zip to write through on new files.

2014-03-20 13:09:37 -05:00

cache.c

Initial work supporting emscripten compilation

2013-09-07 00:39:08 +02:00

calc.c

Add MOD operator '%' in RNumCalc

2014-02-26 19:42:56 +01:00

chmod.c

Fix coverity issues in r_util

2014-03-08 11:56:15 +01:00

constr.c

Update sdb, simplify some makefiles

2013-07-15 02:51:55 +02:00

file.c

Fix some coverity issues

2014-03-16 00:16:43 +01:00

flist.c

Import radare2-capstone asm/anal plugins

2014-03-07 04:15:45 +01:00

graph.c

Fix #370 - Some memory leaks

2013-11-19 01:51:40 +01:00

hex.c

Fix segfault in r_hex_str2bin

2014-03-01 23:17:52 +01:00

ht64.c

New io.buffer cache system and refactorized RHashTable

2013-01-12 04:29:45 +01:00

ht.c

Fix cpp warnings

2013-11-04 04:50:37 +01:00

iconv.c

Update sdb, simplify some makefiles

2013-07-15 02:51:55 +02:00

Jamroot

Merge libr/lib into libr/util and add r_sys_environ API

2014-01-18 02:42:23 +01:00

judy64na.c

Support get/set introspection in 'pf' and handle scr.stride in px

2013-02-01 03:15:48 +01:00

lib.c

Some fixes for RLang plugins

2014-03-26 01:34:32 +01:00

list.c

Rewrote backward disassemble with a greedy backward algorithm, added a find api to rlist, label to bb struct

2013-12-02 00:09:22 +01:00

lock.c

Initial work on the evaluable opcode analysis strings

2013-05-04 02:35:52 +02:00

log.c

Support get/set introspection in 'pf' and handle scr.stride in px

2013-02-01 03:15:48 +01:00

Makefile

Merge libr/lib into libr/util and add r_sys_environ API

2014-01-18 02:42:23 +01:00

mem.c

Fix #630 - Add /v1 and handle cfg.bigendian

2014-02-18 15:34:20 +01:00

mixed.c

…

name.c

Use sscanf again. strtoull is broken (fix testsuite)

2013-11-13 02:30:00 +01:00

num.c

Many bugfixes related to 'drx'. Still not working on linux

2014-01-11 23:48:55 +01:00

p_date.c

Fix coverity issues in r_util

2014-03-08 11:56:15 +01:00

p_format.c

Import radare2-capstone asm/anal plugins

2014-03-07 04:15:45 +01:00

p_seven.c

Support get/set introspection in 'pf' and handle scr.stride in px

2013-02-01 03:15:48 +01:00

pool.c

Fix coverity issues in r_util

2014-03-08 11:56:15 +01:00

print.c

Fix #719 - Fixes in yank and uncrustify indentation rules

2014-03-22 00:37:25 +01:00

prof.c

Fixes parsing bug in java class and and rbinelfFixes in java class and and rbinelf))

2012-11-14 04:57:56 +01:00

randomart.c

Fix some warns and enhace GIT_TAP in makefiles

2013-08-26 01:07:21 +02:00

range.c

Fix some bugs (nullptr, memleak) reported by clang-analyzer

2012-09-26 10:01:43 +02:00

sandbox.c

Fix r_sandbox_check_path – there were ways to perform directory traversal.

2014-03-27 00:32:43 +01:00

slist.c

Use dynamically allocated *next (+15% analysis speedup + better analysis)

2014-02-20 00:43:06 +01:00

str.c

Fix some coverity issues

2014-03-16 00:16:43 +01:00

strbuf.c

Fix coverity issues in r_util

2014-03-08 11:56:15 +01:00

strht.c

Add hints and named print formats and more

2013-01-22 05:06:12 +01:00

strpool.c

Add RCoreLog API ('l' command), '-' cmd is now '$'

2012-12-23 13:52:57 +01:00

sys.c

More sdbization for comments and hints (-250LOC)

2014-03-12 02:44:49 +01:00

thread.c

Fix om for rbin-friendly files, add 'dss'

2012-10-25 15:21:47 +02:00

uleb128.c

dwarf: Implement it.

2014-02-08 14:08:07 +04:00

w32-sys.c

Fix lot of warnings

2013-09-14 14:04:08 +02:00