From: Richard Levitte <levitte@openssl.org>
Date: Sat, 15 Jul 2017 09:21:11 +0000 (+0200)
Subject: OSSL_STORE "file" scheme loader: check that a DOS device is correctly named
X-Git-Tag: OpenSSL_1_1_1-pre1~1035
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=1145995323a2a6b6e31602dbf2c546943a7db06f;p=oweals%2Fopenssl.git

OSSL_STORE "file" scheme loader: check that a DOS device is correctly named

Reviewed-by: Andy Polyakov <appro@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3907)
---

diff --git a/crypto/store/loader_file.c b/crypto/store/loader_file.c
index 31ca2c6315..7cb145753e 100644
--- a/crypto/store/loader_file.c
+++ b/crypto/store/loader_file.c
@@ -783,9 +783,13 @@ static OSSL_STORE_LOADER_CTX *file_open(const OSSL_STORE_LOADER *loader,
 #ifdef _WIN32
         /* Windows file: URIs with a drive letter start with a / */
         if (p[0] == '/' && p[2] == ':' && p[3] == '/') {
-            p++;
-            /* We know it's absolute, so no need to check */
-            path_data[path_data_n].check_absolute = 0;
+            char c = tolower(p[1]);
+
+            if (c >= 'a' && c <= 'z') {
+                p++;
+                /* We know it's absolute, so no need to check */
+                path_data[path_data_n].check_absolute = 0;
+            }
         }
 #endif
         path_data[path_data_n++].path = p;