fusermount: don't feed "escaped commas" into mount options
authorJann Horn <jannh@google.com>
Fri, 13 Jul 2018 22:15:36 +0000 (15:15 -0700)
committerNikolaus Rath <Nikolaus@rath.org>
Sat, 21 Jul 2018 11:17:49 +0000 (12:17 +0100)
commit520f09be3c2d351722c33daf7389d6ac4716be98
tree2ea12463fa3dc7275a371e4c296256e1c93f8383
parentb045ea4bb7a33ae3c6f6fc6e7371708810acd01a
fusermount: don't feed "escaped commas" into mount options

The old code permits the following behavior:

$ _FUSE_COMMFD=10000 priv_strace -etrace=mount -s200 fusermount -o 'foobar=\,allow_other' mount
mount("/dev/fuse", ".", "fuse", MS_NOSUID|MS_NODEV, "foobar=\\,allow_other,fd=3,rootmode=40000,user_id=1000,group_id=1000") = -1 EINVAL (Invalid argument)

However, backslashes do not have any special meaning for the kernel here.

As it happens, you can't abuse this because there is no FUSE mount option
that takes a string value that can contain backslashes; but this is very
brittle. Don't interpret "escape characters" in places where they don't
work.
util/fusermount.c