From 5e93b53f78c403707b58e4c8cf5bf924d59cb51d Mon Sep 17 00:00:00 2001 From: Peter Oberparleiter Date: Tue, 7 Jul 2026 16:55:38 +0200 Subject: [PATCH] zdev: Harden against invalid import data MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reduce chances of unintended side-effects when importing device configuration data which might have been corrupted. Reviewed-by: Vineeth Vijayan Reviewed-by: Jan Höppner Signed-off-by: Peter Oberparleiter Signed-off-by: Jan Höppner --- zdev/src/export.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/zdev/src/export.c b/zdev/src/export.c index 2bb58a62..d7e36c0d 100644 --- a/zdev/src/export.c +++ b/zdev/src/export.c @@ -17,6 +17,7 @@ #include "device.h" #include "devtype.h" #include "export.h" +#include "sanitize.h" #include "setting.h" #include "subtype.h" @@ -35,6 +36,8 @@ static bool header_str_to_config(const char *config_str, config_t *config) if (strstr(config_str, "site")) { if (sscanf(config_str, "site%d", &site) == 1) { + if (site < 0 || site >= NUM_USER_SITES) + return false; import_site_id = site; *config = config_persistent; return true; @@ -333,6 +336,8 @@ static bool parse_setting(const char *line, char **key_ptr, char **val_ptr) value++; *key_ptr = shrink_str(copy); *val_ptr = unquote_str(value); + sanitize(*key_ptr, VALID_ATTRKEY); + sanitize(*val_ptr, VALID_ATTRVAL); free(copy); return true;