From 9c4eb185f184c468c8b52cc6a1e2e469d101351d Mon Sep 17 00:00:00 2001 From: coezff Date: Fri, 19 Jan 2024 00:02:29 +0800 Subject: [PATCH] =?UTF-8?q?CVE-2022-37290=20=E5=AE=89=E5=85=A8=E6=9B=B4?= =?UTF-8?q?=E6=96=B0:Fix=20crash=20when=20copying=20an=20invaild=20file.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- debian/changelog | 6 ++++++ src/nautilus-dbus-manager.c | 5 +++++ src/nautilus-file-operations.c | 6 ++++++ 3 files changed, 17 insertions(+) diff --git a/debian/changelog b/debian/changelog index a74a9a3..a36d411 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +nautilus (1:3.36.1.1-ok4) yangtze; urgency=medium + + * cao_xingyu CVE-2022-37290 安全更新 Fix crash when copying an invaild file. + + -- caoxingyu Thu, 18 Jan 2024 23:59:25 +0800 + nautilus (1:3.36.1.1-ok3) yangtze; urgency=medium * update version info diff --git a/src/nautilus-dbus-manager.c b/src/nautilus-dbus-manager.c index 294b74e..5a8710b 100644 --- a/src/nautilus-dbus-manager.c +++ b/src/nautilus-dbus-manager.c @@ -126,6 +126,11 @@ handle_create_folder (NautilusDBusFileOperations *object, file = g_file_new_for_uri (uri); basename = g_file_get_basename (file); parent_file = g_file_get_parent (file); + if (parent_file == NULL || basename == NULL) + { + g_dbus_method_invocation_return_error (invocation, G_IO_ERROR, G_IO_ERROR_INVALID_ARGUMENT, "Invalid uri: %s", uri); + return TRUE; + } parent_file_uri = g_file_get_uri (parent_file); g_application_hold (g_application_get_default ()); diff --git a/src/nautilus-file-operations.c b/src/nautilus-file-operations.c index 20a320d..604948f 100644 --- a/src/nautilus-file-operations.c +++ b/src/nautilus-file-operations.c @@ -987,6 +987,11 @@ get_basename (GFile *file) if (name == NULL) { basename = g_file_get_basename (file); + if (basename == NULL) + { + return g_strdup (_("unknown")); + } + if (g_utf8_validate (basename, -1, NULL)) { name = basename; @@ -4192,6 +4197,7 @@ get_unique_target_file (GFile *src, if (dest == NULL) { basename = g_file_get_basename (src); + g_assert (basename == NULL); if (g_utf8_validate (basename, -1, NULL)) { -- Gitee