From f6f92b872352e7ee29d7e91552150712437bf808 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20Sj=C3=B6lund?= <erik.sjolund@gmail.com>
Date: Sat, 26 Aug 2023 11:18:00 +0200
Subject: [PATCH] utils: tighten check in check_fd_under_path()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Giuseppe Scrivano <giuseppe@scrivano.org>
Signed-off-by: Erik Sjölund <erik.sjolund@gmail.com>
---
 src/libcrun/utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libcrun/utils.c b/src/libcrun/utils.c
index ce0844481..1b7104a4b 100644
--- a/src/libcrun/utils.c
+++ b/src/libcrun/utils.c
@@ -333,7 +333,7 @@ check_fd_under_path (const char *rootfs, size_t rootfslen, int fd, const char *f
   if (UNLIKELY (ret < 0))
     return crun_make_error (err, errno, "readlink `%s`", fdname);
 
-  if (((size_t) ret) <= rootfslen || memcmp (link, rootfs, rootfslen) != 0)
+  if (((size_t) ret) <= rootfslen || memcmp (link, rootfs, rootfslen) != 0 || link[rootfslen] != '/')
     return crun_make_error (err, 0, "target `%s` not under the directory `%s`", fdname, rootfs);
 
   return 0;