[vlc-devel] [PATCH] sftp: check symbolic links when readdir

[Zhao Zhili]

On 2018年02月11日 00:46, Rémi Denis-Courmont wrote:
> Le lauantaina 10. helmikuuta 2018, 15.44.40 EET Zhao Zhili a écrit :
>> ---
>>   modules/access/sftp.c | 21 ++++++++++++++++++++-
>>   1 file changed, 20 insertions(+), 1 deletion(-)
>>
>> diff --git a/modules/access/sftp.c b/modules/access/sftp.c
>> index 1219f573a1..f200a751b9 100644
>> --- a/modules/access/sftp.c
>> +++ b/modules/access/sftp.c
>> @@ -649,7 +649,26 @@ static int DirRead (stream_t *p_access,
>> input_item_node_t *p_current_node) }
>>           free( psz_uri );
>>
>> -        int i_type = LIBSSH2_SFTP_S_ISDIR( attrs.permissions ) ?
>> ITEM_TYPE_DIRECTORY : ITEM_TYPE_FILE; +        int i_type;
>> +        if( LIBSSH2_SFTP_S_ISDIR( attrs.permissions ) )
>> +        {
>> +            i_type = ITEM_TYPE_DIRECTORY;
>> +        }
>> +        else if( LIBSSH2_SFTP_S_ISLNK( attrs.permissions ) )
>> +        {
>> +            if( libssh2_sftp_stat( p_sys->sftp_session, psz_file, &attrs )
>> ) +            {
>> +                msg_Err( p_access, "Impossible to get information about
>> symbolic link %s", psz_file ); +                free( psz_full_uri );
>> +                break;
>> +            }
>> +            i_type = LIBSSH2_SFTP_S_ISDIR( attrs.permissions ) ?
>> ITEM_TYPE_DIRECTORY : ITEM_TYPE_FILE; +        }
>> +        else
>> +        {
>> +            i_type = ITEM_TYPE_FILE;
>> +        }
>> +
>>           i_ret = vlc_readdir_helper_additem( &rdh, psz_full_uri, NULL,
>> psz_file, i_type, ITEM_NET );
>>           free( psz_full_uri );
> If you want to resolve links, you should use the equivalent of stat() instead
> of lstat(). If there is no such thing, then that problem is not out of VLC
> scope.
>
> Otherwise, you can also have links to links, and so on, and even circular
> links.
>

There are libssh2_sftp_stat and libssh2_sftp_lstat, the patch did use
libssh2_sftp_stat. I made two mistake, check psz_file instead of the full
path, and break the loop for broken links. A new patch is following. Maybe
there are other mistakes I haven't noticed, please review.