fusermount: don't feed "escaped commas" into mount options
authorJann Horn <jannh@google.com>
Fri, 13 Jul 2018 22:15:36 +0000 (15:15 -0700)
committerNikolaus Rath <Nikolaus@rath.org>
Wed, 18 Jul 2018 19:32:28 +0000 (20:32 +0100)
commit28bdae3d113ef479c1660a581ef720cdc33bf466
tree966809637574871cc64628f909cb8ea0fa291ae9
parent34c62ee90c69b07998629f6b5a06ab0120be681c
fusermount: don't feed "escaped commas" into mount options

The old code permits the following behavior:

$ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount
mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument)

However, backslashes do not have any special meaning for the kernel here.

As it happens, you can't abuse this because there is no FUSE mount option
that takes a string value that can contain backslashes; but this is very
brittle. Don't interpret "escape characters" in places where they don't
work.
util/fusermount.c