#275 Command injection via db_dir configuration parameter

[Michele Spagnuolo]

There is a command injection vulnerability via the db_dir configuration parameter.

To reproduce:

1. Use this configuration file minidlna.conf: db_dir=x; cat /etc/passwd;#
2. Run minidlna -f minidlna.conf
3. The injected command is executed.

This is risky because minidlna is used in several routers, executed with elevated privileges, and that parameter might be controllable by an attacker.

The vulnerable code is located at https://github.com/1100101/minidlna/blob/master/minidlna.c#L454 and at line 890 of the same file, when the -R flag is specified explicitly. Please avoid string concatenation to parameters passed to system().

[Shrimpkin]

Issues with minidlna.c and system() have been previously reported in Tickets>Bugs #273.