1.1 --- a/extensions/updater/extension.cpp	Tue Feb 17 16:39:02 2009 -0500
     1.2 +++ b/extensions/updater/extension.cpp	Tue Feb 17 16:58:17 2009 -0500
     1.3 @@ -127,6 +127,12 @@
     1.4  	UpdatePart *part = (UpdatePart*)data;
     1.5  	while (part != NULL)
     1.6  	{
     1.7 +		if (strstr(part->file, "..") != NULL)
     1.8 +		{
     1.9 +			/* Naughty naughty */
    1.10 +			AddUpdateError("Detected invalid path escape (..): %s", part->file);
    1.11 +			goto skip_create;
    1.12 +		}
    1.13  		if (part->data == NULL)
    1.14  		{
    1.15  			smutils->BuildPath(Path_SM, path, sizeof(path), "gamedata/%s", part->file);
    1.16 @@ -158,6 +164,7 @@
    1.17  				"Successfully updated gamedata file \"%s\"",
    1.18  				part->file);
    1.19  		}
    1.20 +skip_create:
    1.21  		temp = part->next;
    1.22  		free(part->data);
    1.23  		free(part->file);