+/* Make path appear as if a chroot had occurred. This handles a leading
+ * "/" (either removing it or expanding it) and any leading or embedded
+ * ".." components that attempt to escape past the module's top dir.
+ *
+ * If dest is NULL, a buffer is allocated to hold the result. If dest is
+ * the same buffer as p (the path) OR if reldir is NULL, a leading slash
+ * is dropped instead of being expanded to be the module's top dir.
+ *
+ * If reldir is non-NULL (and non-empty), it is a sanitized directory that
+ * the path will be relative to, so allow as many '..'s at the beginning of
+ * the path as there are components in reldir. This is used for symbolic
+ * link targets. If reldir is non-null and the path began with "/", to be
+ * completely like a chroot we should add in depth levels of ".." at the
+ * beginning of the path, but that would blow the assumption that the path
+ * doesn't grow and it is not likely to end up being a valid symlink
+ * anyway, so just do the normal removal of the leading "/" instead.
+ *
+ * While we're at it, remove double slashes and "." components like
+ * clean_fname() does, but DON'T remove a trailing slash because that is
+ * sometimes significant on command line arguments.
+ *
+ * If the resulting path would be empty, change it into ".".
+ */
+char *sanitize_path(char *dest, const char *p, const char *reldir)
+{
+ char *start, *sanp;
+ int depth = 0;
+ int allowdotdot = 0;
+ int rlen = 0;
+
+ if (dest != p) {
+ int plen = strlen(p);
+ if (*p == '/' && reldir) {
+ rlen = strlen(lp_path(module_id));
+ reldir = NULL;
+ p++;
+ }
+ if (dest) {
+ if (rlen + plen + 1 >= MAXPATHLEN)
+ return NULL;
+ } else if (!(dest = new_array(char, rlen + plen + 1)))
+ out_of_memory("sanitize_path");
+ if (rlen) {
+ memcpy(dest, lp_path(module_id), rlen);
+ if (rlen > 1)
+ dest[rlen++] = '/';
+ }
+ }
+
+ if (reldir) {
+ int new_component = 1;
+ while (*reldir) {
+ if (*reldir++ == '/')
+ new_component = 1;
+ else if (new_component) {
+ new_component = 0;
+ depth++;
+ }
+ }
+ }
+
+ start = sanp = dest + rlen;
+ while (*p == '/') {
+ /* remove leading slashes */
+ p++;
+ }
+ while (*p != '\0') {
+ /* this loop iterates once per filename component in p.
+ * both p (and sanp if the original had a slash) should
+ * always be left pointing after a slash
+ */
+ if (*p == '.' && (p[1] == '/' || p[1] == '\0')) {
+ /* skip "." component */
+ while (*++p == '/') {
+ /* skip following slashes */
+ ;
+ }
+ continue;
+ }
+ allowdotdot = 0;
+ if (*p == '.' && p[1] == '.' && (p[2] == '/' || p[2] == '\0')) {
+ /* ".." component followed by slash or end */
+ if (depth > 0 && sanp == start) {
+ /* allow depth levels of .. at the beginning */
+ --depth;
+ allowdotdot = 1;
+ } else {
+ p += 2;
+ if (*p == '/')
+ p++;
+ if (sanp != start) {
+ /* back up sanp one level */
+ --sanp; /* now pointing at slash */
+ while (sanp > start && sanp[-1] != '/') {
+ /* skip back up to slash */
+ sanp--;
+ }
+ }
+ continue;
+ }
+ }
+ while (1) {
+ /* copy one component through next slash */
+ *sanp++ = *p++;
+ if (*p == '\0' || p[-1] == '/') {
+ while (*p == '/') {
+ /* skip multiple slashes */
+ p++;
+ }
+ break;
+ }
+ }
+ if (allowdotdot) {
+ /* move the virtual beginning to leave the .. alone */
+ start = sanp;
+ }
+ }
+ if (sanp == dest) {
+ /* ended up with nothing, so put in "." component */
+ *sanp++ = '.';
+ }
+ *sanp = '\0';
+
+ return dest;
+}