mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-08-31 09:45:24 +02:00
Henrik Rydgård
93a8b0e501
fileName is taken verbatim from the index file (only a leading slash is stripped) and then used essentially unsanitized to build a path under basePath (GetLocalPath() is a plain string join, unlike MetaFileSystem::RealPath which does collapse ".." for normal game file access). A crafted index file - these virtual-disc folders are commonly shared/downloaded as homebrew - could use a ".." component to make PPSSPP probe or open arbitrary host files/directories outside the intended folder just by loading it. Reuse the existing HasParentDirComponent() helper (already used for the same purpose in GameManager's zip extraction) to reject such entries.