rt/snapraid
1
0
Fork 0
mirror of https://github.com/amadvance/snapraid.git synced 2026-10-26 19:01:57 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Validate WMI-returned VSS snapshot GUID format in mingwapp.c to mitigate potential command injection

Browse source
This commit is contained in:
Andrea Mazzoleni 2026-07-16 22:39:27 +02:00
parent 7aff21e3a9
commit 0051c58231
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
cmdline/mingwapp.c
View file

@ -541,6 +541,12 @@ int fssnapshot_create(const struct fssnapshot_struct* fss, const char* name)
const char* guid = out + 3;
if (windows_guid_is_valid(guid, strlen(guid)) != 0) {
errno = EINVAL;
log_error(errno, "Invalid GUID received from VSS shadow copy creation: '%s'\n", guid);
return -1;
}
/* resolve the shadow copy's device object path */
snprintf(cmd, sizeof(cmd), "(Get-WmiObject Win32_ShadowCopy | Where-Object {$_.ID -eq '%s'}).DeviceObject", guid);
if (windows_ps(cmd, device_path, sizeof(device_path)) != 0) {