X-Git-Url: https://mattmccutchen.net/rsync/rsync.git/blobdiff_plain/eb86d661d79f25c91788964a768b54223717e8f6..4b957c22381cf1848ff6a5e59249bb71ba79e9fa:/util.c

diff --git a/util.c b/util.c
index 34c8f8b0..bfa35f18 100644
--- a/util.c
+++ b/util.c
@@ -686,7 +686,7 @@ int u_strcmp(const char *cs1, const char *cs2)
 	return (int)*s1 - (int)*s2;
 }
 
-static int last_pct = -1;
+static OFF_T last_ofs;
 
 void end_progress(void)
 {
@@ -695,7 +695,7 @@ void end_progress(void)
 	if (do_progress && !am_server) {
 		rprintf(FINFO,"\n");
 	}
-	last_pct = -1;
+	last_ofs = 0;
 }
 
 void show_progress(OFF_T ofs, OFF_T size)
@@ -703,10 +703,57 @@ void show_progress(OFF_T ofs, OFF_T size)
 	extern int do_progress, am_server;
 
 	if (do_progress && !am_server) {
-		int pct = (int)((100.0*ofs)/size + 0.5);
-		if (pct != last_pct) {
+		if (ofs > last_ofs + 1000) {
+			int pct = (int)((100.0*ofs)/size);
 			rprintf(FINFO,"%.0f (%d%%)\r", (double)ofs, pct);
-			last_pct = pct;
+			last_ofs = ofs;
 		}
 	}
 }
+
+/* determine if a symlink points outside the current directory tree */
+int unsafe_symlink(char *dest, char *src)
+{
+	char *tok;
+	int depth = 0;
+
+	/* all absolute and null symlinks are unsafe */
+	if (!dest || !(*dest) || (*dest == '/')) return 1;
+
+	src = strdup(src);
+	if (!src) out_of_memory("unsafe_symlink");
+
+	/* find out what our safety margin is */
+	for (tok=strtok(src,"/"); tok; tok=strtok(NULL,"/")) {
+		if (strcmp(tok,"..") == 0) {
+			depth=0;
+		} else if (strcmp(tok,".") == 0) {
+			/* nothing */
+		} else {
+			depth++;
+		}
+	}
+	free(src);
+
+	/* drop by one to account for the filename portion */
+	depth--;
+
+	dest = strdup(dest);
+	if (!dest) out_of_memory("unsafe_symlink");
+
+	for (tok=strtok(dest,"/"); tok; tok=strtok(NULL,"/")) {
+		if (strcmp(tok,"..") == 0) {
+			depth--;
+		} else if (strcmp(tok,".") == 0) {
+			/* nothing */
+		} else {
+			depth++;
+		}
+		/* if at any point we go outside the current directory then
+		   stop - it is unsafe */
+		if (depth < 0) break;
+	}
+
+	free(dest);
+	return (depth < 0);
+}