[vlc-commits] [Git][videolan/vlc][3.0.x] 3 commits: skins2: parser: limit recursivity

[Felix Paul Kühne (@fkuehne)]

Felix Paul Kühne pushed to branch 3.0.x at VideoLAN / VLC


Commits:
a10e0a66 by François Cartegnie at 2026-07-17T13:39:42+02:00
skins2: parser: limit recursivity

(cherry picked from commit c2f200231e62b238310474f57eac2582c365487c)

- - - - -
f922378c by François Cartegnie at 2026-07-17T13:39:42+02:00
skins2: parser: restrict subpath

(cherry picked from commit ef4c8f4de9c8864687f686a8fae5d03eae644feb)

- - - - -
cb9931fe by François Cartegnie at 2026-07-17T13:39:42+02:00
skins2: clean up failed extractions

(cherry picked from commit c1fed8e210f34481b8a106a189c3ce665fe58d30)

- - - - -


3 changed files:

- modules/gui/skins2/parser/skin_parser.cpp
- modules/gui/skins2/parser/skin_parser.hpp
- modules/gui/skins2/src/theme_loader.cpp


Changes:

=====================================
modules/gui/skins2/parser/skin_parser.cpp
=====================================
@@ -27,9 +27,9 @@
 #include <math.h>
 
 SkinParser::SkinParser( intf_thread_t *pIntf, const std::string &rFileName,
-                        const std::string &rPath, BuilderData *pData ):
+                        const std::string &rPath, BuilderData *pData, unsigned instance ):
     XMLParser( pIntf, rFileName ), m_path( rPath ), m_pData( pData ),
-    m_ownData( pData == NULL ), m_xOffset( 0 ), m_yOffset( 0 )
+    m_ownData( pData == NULL ), m_xOffset( 0 ), m_yOffset( 0 ), m_instanceCount( instance )
 {
     // Make sure the data is allocated
     if( m_pData == NULL )
@@ -64,6 +64,30 @@ inline bool SkinParser::MissingAttr( AttrList_t &attr, const std::string &name,
     return false;
 }
 
+static bool isSubPath( const std::string &base, const std::string &path, const std::string &dirsep )
+{
+    char *baseReal = realpath( base.c_str(), NULL );
+    char *pathReal = realpath( path.c_str(), NULL );
+
+    if( !baseReal || !pathReal )
+    {
+        free( baseReal );
+        free( pathReal );
+        return false;
+    }
+
+    std::string basePath = baseReal;
+    std::string subPath = pathReal;
+    free( baseReal );
+    free( pathReal );
+
+    if( basePath.size() < dirsep.size() ||
+        basePath.compare( basePath.size() - dirsep.size(), dirsep.size(), dirsep ) )
+        basePath += dirsep;
+
+    return subPath.compare( 0, basePath.size(), basePath ) == 0;
+}
+
 void SkinParser::handleBeginElement( const std::string &rName, AttrList_t &attr )
 {
 #define RequireAttr( attr, name, a ) \
@@ -71,12 +95,24 @@ void SkinParser::handleBeginElement( const std::string &rName, AttrList_t &attr
 
     if( rName == "Include" )
     {
+        if( m_instanceCount >= 4 )
+        {
+            m_errors = true;
+            return;
+        }
         RequireAttr( attr, rName, "file" );
 
         OSFactory *pFactory = OSFactory::instance( getIntf() );
         std::string fullPath = m_path + pFactory->getDirSeparator() + attr["file"];
+        if( !isSubPath( m_path, fullPath, pFactory->getDirSeparator() ) )
+        {
+            msg_Err( getIntf(), "bad theme: Include escapes theme directory: %s",
+                     attr["file"] );
+            m_errors = true;
+            return;
+        }
         msg_Dbg( getIntf(), "opening included XML file: %s", fullPath.c_str() );
-        SkinParser subParser( getIntf(), fullPath.c_str(), m_path, m_pData );
+        SkinParser subParser( getIntf(), fullPath.c_str(), m_path, m_pData, m_instanceCount + 1 );
         subParser.parse();
     }
 


=====================================
modules/gui/skins2/parser/skin_parser.hpp
=====================================
@@ -44,7 +44,7 @@ public:
     };
 
     SkinParser( intf_thread_t *pIntf, const std::string &rFileName,
-                const std::string &rPath, BuilderData *pData = NULL );
+                const std::string &rPath, BuilderData *pData = NULL, unsigned = 0 );
     virtual ~SkinParser();
 
     const BuilderData &getData() const { return *m_pData; }
@@ -76,6 +76,8 @@ private:
     int m_curLayer;
     /// Set of used id
     std::set<std::string> m_idSet;
+    /// recursive depth control
+    unsigned m_instanceCount;
 
     /// Callbacks
     virtual void handleBeginElement( const std::string &rName,


=====================================
modules/gui/skins2/src/theme_loader.cpp
=====================================
@@ -135,6 +135,7 @@ bool ThemeLoader::extract( const std::string &fileName )
     if( unarchive( fileName, tempPath ) == false )
     {
         msg_Err( getIntf(), "extraction from %s failed", fileName.c_str() );
+        deleteTempFiles( tempPath );
         return false;
     }
 



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/010116448cd55f8c95ba98745f38f9d2762b0766...cb9931fedf37b600cb57f0234d26fdf3028af262

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/010116448cd55f8c95ba98745f38f9d2762b0766...cb9931fedf37b600cb57f0234d26fdf3028af262
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help