@@ -186,6 +186,7 @@ class YAFFSEntry:
186
186
sum_no_longer_used : int = attr .ib (default = 0 )
187
187
name : str = attr .ib (default = "" )
188
188
alias : str = attr .ib (default = "" )
189
+ equiv_id : int = attr .ib (default = 0 )
189
190
file_size : int = attr .ib (default = 0 )
190
191
st_mode : int = attr .ib (default = 0 )
191
192
st_uid : int = attr .ib (default = 0 )
@@ -210,7 +211,6 @@ def __str__(self):
210
211
@attr .define (kw_only = True )
211
212
class YAFFS2Entry (YAFFSEntry ):
212
213
chksum : int = attr .ib (default = 0 )
213
- equiv_id : int = attr .ib (default = 0 )
214
214
st_rdev : int = attr .ib (default = 0 )
215
215
win_ctime : List [int ] = attr .ib (default = [])
216
216
win_mtime : List [int ] = attr .ib (default = [])
@@ -526,7 +526,7 @@ def extract_entry(self, entry: YAFFSEntry, outdir: Path): # noqa: C901
526
526
for chunk in self .get_file_bytes (entry ):
527
527
f .write (chunk )
528
528
elif entry .object_type == YaffsObjectType .SYMLINK :
529
- if not is_safe_path (outdir , out_path / Path (entry .alias )):
529
+ if not is_safe_path (outdir , out_path . parent / Path (entry .alias )):
530
530
logger .warning (
531
531
"Potential path traversal attempt through symlink" ,
532
532
outdir = outdir ,
@@ -536,21 +536,18 @@ def extract_entry(self, entry: YAFFSEntry, outdir: Path): # noqa: C901
536
536
logger .debug ("creating symlink" , file_path = out_path , _verbosity = 3 )
537
537
out_path .symlink_to (Path (entry .alias ))
538
538
elif entry .object_type == YaffsObjectType .HARDLINK :
539
- if not isinstance (entry , YAFFS2Entry ):
540
- logger .warning ("non YAFFS2 hardlink object" , entry = entry )
541
- return
542
-
543
539
logger .debug ("creating hardlink" , file_path = out_path , _verbosity = 3 )
544
- src_entry = self .file_entries [entry .equiv_id ]
545
- src_path = self .resolve_path (src_entry )
546
- if not is_safe_path (outdir , out_path / src_path ):
540
+ dst_entry = self .file_entries [entry .equiv_id ]. data
541
+ dst_path = self .resolve_path (dst_entry )
542
+ if not is_safe_path (outdir , dst_path ):
547
543
logger .warning (
548
544
"Potential path traversal attempt through hardlink" ,
549
545
outdir = outdir ,
550
- path = src_path ,
546
+ path = dst_path ,
551
547
)
552
548
return
553
- src_path .link_to (out_path )
549
+ dst_full_path = outdir / dst_path
550
+ dst_full_path .link_to (out_path )
554
551
555
552
556
553
class YAFFS2Parser (YAFFSParser ):
@@ -699,6 +696,7 @@ def build_entry(self, header: Instance, chunk: YAFFSChunk) -> YAFFSEntry:
699
696
name = snull (header .name [0 :128 ]).decode ("utf-8" ),
700
697
alias = snull (header .alias .replace (b"\xFF " , b"" )).decode ("utf-8" ),
701
698
file_size = header .file_size ,
699
+ equiv_id = header .equivalent_object_id ,
702
700
)
703
701
704
702
def get_chunks (self , object_id : int ) -> Iterable [YAFFS1Chunk ]:
0 commit comments