commit 5547a835c9c5e7d710c97ac88660b461cc162a0a
from: Omar Polo <op@omarpolo.com>
date: Mon Dec 20 19:56:28 2021 UTC

Tcreate: check against ".", ".." and files with `/' in them.

commit - c7f145d4ed3211b02d766e9f126e27a3dda1b871
commit + 5547a835c9c5e7d710c97ac88660b461cc162a0a
blob - 32a518e8dd3bdc1c0eecb0a6b2f15cc7952f4141
blob + 5dee77d3c2edb602fb3b668eb6f88ed3472d854f
--- client.c
+++ client.c
@@ -1250,6 +1250,12 @@ tcreate(struct np_msg_header *hdr, const uint8_t *data
 	if (!NPREAD32("perm", &perm, &data, &len) ||
 	    !NPREAD8("mode", &mode, &data, &len))
 		goto err;
+
+	if (!strcmp(name, ".") || !strcmp(name, "..") ||
+	    strchr(name, '/') != NULL) {
+		np_error(hdr->tag, "invalid name");
+		return;
+	}
 
 	if ((f = fid_by_id(fid)) == NULL || f->fd != -1) {
 		np_error(hdr->tag, "invalid fid");