$ python3 cve-2025-6218.py

void file_name_check(char *a1){
  cur_filename = a1;
  j = 0;
  cur_pos = 0;
  if ( *(a1 + 4) > 0 )
  {
    offset = 0;
    while ( 1 )
    {
      if ( (cur_pos + 1) == cur_filename[2] )
        goto BREAK;
      str = cur_filename;
      if ( cur_filename[3] > 7 )
        str = *cur_filename;
      if ( str[offset + 1] == '\\' || str[offset + 1] == '/' )
      {
BREAK:
        if ( cur_pos >= 0 )
          break;
      }
LOOP_START:
      ++cur_pos;
      ++offset;
      if ( cur_pos >= *(cur_filename + 4) )
        goto LABEL_47;
    }
    while ( 1 )
    {
      if ( str[offset] != '.' )
      {
        if ( str[offset] != ' ' )
          goto LOOP_START;
      }
      if ( !cur_pos )
      {
        if ( str[offset] == ' ' )
        {
          str[offset] = '_';
          goto LOOP_START;
        }
      }
      if ( str[offset] == '.' )
      {
        if ( !cur_pos )
          goto LOOP_START;
        if ( str[offset - 1] == '\\' || str[offset - 1] == '/' )
          goto LOOP_START;
        if ( cur_pos == 2 )
        {
          if ( is_safe_character(cur_filename) )
            goto LOOP_START;
        }
        else if ( cur_pos < 1 )
        {
          goto DELETE;
        }
        if ( str[offset - 1] == '.' )
        {
          if ( cur_pos == 1 )
            goto LOOP_START;
          if ( str[offset - 2] == '\\' || str[offset - 2] == '/' || cur_pos == 3 && is_safe_character(cur_filename) )
            goto LOOP_START;
        }
      }
DELETE:
      delete_char(cur_filename, cur_pos, 1u);
      --offset;
      if ( --cur_pos < 0 )
        goto LOOP_START;
    }
  }

//...
}

void __fastcall file_name_check(char **a1){
  cur_filename = a1;
  j = 0;
  if ( *(a1 + 4) > 0 )
  {
    offset = 0;
    fname_index = 1;
    do
    {
      if ( fname_index == cur_filename[2] )
        goto HANDLE_DIR_NEXT;
      str = cur_filename;
      if ( str[offset + 1] == '\\' || str[offset + 1] == '/' )
      {
HANDLE_DIR_NEXT:
        if ( offset >= 0 )
        {
          if ( str[offset] == '.' )
            goto FILENAME_BEGINS;
          if ( str[offset] == ' ' )
          {
FILENAME_BEGINS:
            if ( str[offset] != '.' )
              goto CONT;
            if ( offset )
            {
              if ( str[offset - 1] != '\\'
                && str[offset - 1] != '/'
                && (offset != 2 || !is_safe_character(cur_filename)) )
              {
                if ( str[offset - 1] != '.' )
                  goto CONT;
                if ( offset != 1 )
                {
                  if ( str[offset - 2] != '\\'
                    && str[offset - 2] != '/'
                    && (offset != 3 || !is_safe_character(cur_filename)) )
                  {
CONT:
                    str[offset] = '_';
                  }
                }
              }
            }
          }
        }
      }
      ++j;
      ++offset;
      ++fname_index;
    }
    while ( j < *(cur_filename + 4) );
  }

//...

}