Closed mklein-de closed 1 year ago
Thanks for the PR! I'm just going through the process of verifying this bug and then testing this fix.
I'm thinking that an even more robust solution might be to implement an "exact string match" function in minilibc, which would be a trivial modification to the existing mlc_strncasecmp()
. However your fix should be good enough for now.
path traversal checked only if a directory entry name starts with the current directory element, e.g. looking for
.r/rockbox.ipod
would even match./rockbox/rockbox.ipod
because.rockbox
begins with.r