Project xrefs untrusted input

Susanne588586 commented 10 years ago

[0x0040488f]> Pi test info
Project : /home/biatch/.config/radare2/rdb/test info
[0x0040488f]> P test
Usage: P[?osi] [file]
 Po [file]  open project
 Ps [file]  save project
 Pi [file]  info
NOTE: project files are stored in ~/.config/radare2/rdb
[0x0040488f]> Po test
xdg-open: file 'a.gif' does not exist <--------------------------------------------------- wat
$ file ~/.config/radare2/rdb/test.d/xrefs
/home/biatch/.config/radare2/rdb/test.d/xrefs: GLS_BINCRY_LSB_FIRST
$ strings -n 1000 ~/.config/radare2/rdb/test.d/xrefs 
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

Projects should have a checksum, or valid xref file check.

radare commented 10 years ago

I have fixed those issues. the xrefs file is not a radare script, its an sdb database. I have opened a TODO point in sdb to support a checksum to verify its contents.

Thanks for reporting

radare commented 10 years ago

Btw, you are reporting various issues in one. See that "Pi test info" is checking for a project name with a space in its name.

radareorg / radare2

Project xrefs untrusted input #491