Sanity check any command line device node argument

Signed-off-by: Joachim Wiberg <[email protected]>

src/wdt.c

@@ -648,18 +648,26 @@ static void period_cb(uev_t *w, void *arg, int event)
  * Initialize, or reinitialize, connection to WDT.  Set timeout and
  * start a WDT kick timer.
  */
-int wdt_init(uev_ctx_t *ctx, const char *devnode)
+int wdt_init(uev_ctx_t *ctx, const char *name)
 {
 	struct wdt *dev;
 
 	if (wdt_testmode())
 		return 0;
 
-	if (devnode) {
+	if (name) {
+		char devnode[256];
+
+		/* Sanity check device name */
+		strlcpy(devnode, name, sizeof(devnode));
+		if (strncmp(devnode, _PATH_DEV, strlen(_PATH_DEV)) || strstr(devnode, ".."))
+			goto skip;
+
 		/* Check if already in .conf file */
 		dev = find(devnode);
 		if (!dev)
 			wdt_add(devnode, period, timeout, magic, 1);
+	skip:
 	}
 
 	TAILQ_FOREACH(dev, &devices, link) {