Bug 15476 - cd allows odd .... directory
Summary: cd allows odd .... directory
Status: NEW
Alias: None
Product: Busybox
Classification: Unclassified
Component: Other (show other bugs)
Version: unspecified
Hardware: PC Linux
: P5 minor
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-03-22 15:39 UTC by Michel Stam
Modified: 2023-03-31 14:47 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:


Attachments
busybox .config (28.71 KB, text/plain)
2023-03-22 15:39 UTC, Michel Stam
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Michel Stam 2023-03-22 15:39:17 UTC
Created attachment 9556 [details]
busybox .config

Hi guys,

I mistyped a directory name by working on an OpenWRT box running an older version of busybox executing 'cd .../..' instead of 'cd ../..'. The command returns exit code 0, but doesn't seem to do anything.

I did some further investigation, executing 'cd ................................/..' and still this is allowed. 'cd ../...' returns the expected "can't cd to" error, however 'cd ../........./..' again executes (and goes only one directory up).

Any thoughts?

Built on a PC, but also observed on 2 different AARCH64 systems, each one running older versions of OpenWRT (2018 and 2020 from memory). This suggests this has been around for a while.

Config is mostly default, I ran:
git clone https://git.busybox.net/busybox.git
cd busybox
git checkout master
make defconfig
make menuconfig <<<<< disable seedrng, it cannot find sys/random.h
make
busybox ash
cd ....../.. <<<<<<< or any of the other mentioned commands.

Hope it helps.

Cheers,

Michel
Comment 1 Denys Vlasenko 2023-03-31 14:47:10 UTC
cd DIR

cdcmd() -> docd() -> updatepwd(), and updatepwd has the code which "normalizes" the DIR: prepends current dir if DIR is not absolute, then eliminates "SUBDIR/.." sections.

The bug is, it does not care whether SUBDIR exists:

cd BOGUSDIR/../existing_dir

works.

The same exact code is in dash. Needs to be fixed there first.