Bug 15476

Summary:	cd allows odd .... directory
Product:	Busybox	Reporter:	Michel Stam <mstam>
Component:	Other	Assignee:	unassigned
Status:	NEW ---
Severity:	minor	CC:	busybox-cvs
Priority:	P5
Version:	unspecified
Target Milestone:	---
Hardware:	PC
OS:	Linux
Host:		Target:
Build:
Attachments:	busybox .config

Description Michel Stam 2023-03-22 15:39:17 UTC

Created attachment 9556 [details]
busybox .config

Hi guys,

I mistyped a directory name by working on an OpenWRT box running an older version of busybox executing 'cd .../..' instead of 'cd ../..'. The command returns exit code 0, but doesn't seem to do anything.

I did some further investigation, executing 'cd ................................/..' and still this is allowed. 'cd ../...' returns the expected "can't cd to" error, however 'cd ../........./..' again executes (and goes only one directory up).

Any thoughts?

Built on a PC, but also observed on 2 different AARCH64 systems, each one running older versions of OpenWRT (2018 and 2020 from memory). This suggests this has been around for a while.

Config is mostly default, I ran:
git clone https://git.busybox.net/busybox.git
cd busybox
git checkout master
make defconfig
make menuconfig <<<<< disable seedrng, it cannot find sys/random.h
make
busybox ash
cd ....../.. <<<<<<< or any of the other mentioned commands.

Hope it helps.

Cheers,

Michel

Comment 1 Denys Vlasenko 2023-03-31 14:47:10 UTC

cd DIR

cdcmd() -> docd() -> updatepwd(), and updatepwd has the code which "normalizes" the DIR: prepends current dir if DIR is not absolute, then eliminates "SUBDIR/.." sections.

The bug is, it does not care whether SUBDIR exists:

cd BOGUSDIR/../existing_dir

works.

The same exact code is in dash. Needs to be fixed there first.