backlight: Fix security issues in handling of the interface path name.

- don't allow '/' in the interface name to avoid escaping the /sys
  hierarchy
- check snprintf() return value for overflow.

Problems reported by  Adam Sampson. Thanks.

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
Reviewed-by: Reviewed-by: Hans de Goede <hdegoede@redhat.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/tools/backlight_helper.c b/tools/backlight_helper.c
index 11abebc2..24958ec6 100644
--- a/tools/backlight_helper.c
+++ b/tools/backlight_helper.c
@@ -17,7 +17,15 @@ int main(int argc, char *argv[])
 		return 1;
 	}
 
-	snprintf(buf, sizeof(buf), "/sys/class/backlight/%s/brightness", argv[1]);
+	if (strchr(argv[1], '/') != NULL) {
+		fprintf(stderr, "Invalid interface name\n");
+		return 1;
+	}
+	if (snprintf(buf, sizeof(buf), "/sys/class/backlight/%s/brightness",
+		argv[1]) >= sizeof(buf)) {
+		fprintf(stderr, "Interface name is too long\n");
+		return 1;
+	}
 	fd = open(buf, O_RDWR);
 	if (fd < 0 || fstat(fd, &st) || major(st.st_dev)) {
 		fprintf(stderr, "Cannot access backlight interface '%s'\n", argv[1]);