diff --git a/res/stasis_recording/stored.c b/res/stasis_recording/stored.c index 9df5d75dc6..ac216ff8c0 100644 --- a/res/stasis_recording/stored.c +++ b/res/stasis_recording/stored.c @@ -330,6 +330,7 @@ struct stasis_app_stored_recording *stasis_app_stored_recording_find_by_name( RAII_VAR(char *, file_with_ext, NULL, ast_free); int res; struct stat file_stat; + int prefix_len = strlen(ast_config_AST_RECORDING_DIR); errno = 0; @@ -350,18 +351,28 @@ struct stasis_app_stored_recording *stasis_app_stored_recording_find_by_name( ast_string_field_build(recording, file, "%s/%s", dir, file); if (!ast_begins_with(dir, ast_config_AST_RECORDING_DIR)) { - /* Attempt to escape the recording directory */ - ast_log(LOG_WARNING, "Attempt to access invalid recording %s\n", - name); - errno = EACCES; - return NULL; + /* It's possible that one or more component of the recording path is + * a symbolic link, this would prevent dir from ever matching. */ + char *real_basedir = realpath(ast_config_AST_RECORDING_DIR, NULL); + + if (!real_basedir || !ast_begins_with(dir, real_basedir)) { + /* Attempt to escape the recording directory */ + ast_log(LOG_WARNING, "Attempt to access invalid recording directory %s\n", + dir); + ast_std_free(real_basedir); + errno = EACCES; + + return NULL; + } + + prefix_len = strlen(real_basedir); + ast_std_free(real_basedir); } /* The actual name of the recording is file with the config dir * prefix removed. */ - ast_string_field_set(recording, name, - recording->file + strlen(ast_config_AST_RECORDING_DIR) + 1); + ast_string_field_set(recording, name, recording->file + prefix_len + 1); file_with_ext = find_recording(dir, file); if (!file_with_ext) {