summaryrefslogtreecommitdiffstats
path: root/app-arch/unzip/files/unzip-5.50-dotdot.patch
diff options
context:
space:
mode:
authorSuren A. Chilingaryan <csa@suren.me>2019-09-01 00:00:32 +0200
committerSuren A. Chilingaryan <csa@suren.me>2019-09-01 00:00:32 +0200
commitca9627e70852f6b2e835660df870fe3ab405882d (patch)
tree0a008b1d5b16fa0679a195ed7b5662c7891f591c /app-arch/unzip/files/unzip-5.50-dotdot.patch
downloaddarklin4-ca9627e70852f6b2e835660df870fe3ab405882d.tar.gz
darklin4-ca9627e70852f6b2e835660df870fe3ab405882d.tar.bz2
darklin4-ca9627e70852f6b2e835660df870fe3ab405882d.tar.xz
darklin4-ca9627e70852f6b2e835660df870fe3ab405882d.zip
Initial import
Diffstat (limited to 'app-arch/unzip/files/unzip-5.50-dotdot.patch')
-rw-r--r--app-arch/unzip/files/unzip-5.50-dotdot.patch84
1 files changed, 84 insertions, 0 deletions
diff --git a/app-arch/unzip/files/unzip-5.50-dotdot.patch b/app-arch/unzip/files/unzip-5.50-dotdot.patch
new file mode 100644
index 0000000..962a302
--- /dev/null
+++ b/app-arch/unzip/files/unzip-5.50-dotdot.patch
@@ -0,0 +1,84 @@
+Only in unzip-5.50-lhh/: cscope.files
+Only in unzip-5.50-lhh/: cscope.out
+diff -ur unzip-5.50/unix/unix.c unzip-5.50-lhh/unix/unix.c
+--- unzip-5.50/unix/unix.c 2002-01-21 17:54:42.000000000 -0500
++++ unzip-5.50-lhh/unix/unix.c 2003-06-11 18:35:38.000000000 -0400
+@@ -421,7 +421,8 @@
+ */
+ {
+ char pathcomp[FILNAMSIZ]; /* path-component buffer */
+- char *pp, *cp=(char *)NULL; /* character pointers */
++ char *pp, *cp=(char *)NULL, /* character pointers */
++ *dp=(char *)NULL;
+ char *lastsemi=(char *)NULL; /* pointer to last semi-colon in pathcomp */
+ #ifdef ACORN_FTYPE_NFS
+ char *lastcomma=(char *)NULL; /* pointer to last comma in pathcomp */
+@@ -429,6 +430,7 @@
+ #endif
+ int quote = FALSE; /* flags */
+ int killed_ddot = FALSE; /* is set when skipping "../" pathcomp */
++ int snarf_ddot = FALSE; /* Is set while scanning for "../" */
+ int error = MPN_OK;
+ register unsigned workch; /* hold the character being tested */
+
+@@ -467,6 +469,9 @@
+ while ((workch = (uch)*cp++) != 0) {
+
+ if (quote) { /* if character quoted, */
++ if ((pp == pathcomp) && (workch == '.'))
++ /* Oh no you don't... */
++ goto ddot_hack;
+ *pp++ = (char)workch; /* include it literally */
+ quote = FALSE;
+ } else
+@@ -481,15 +486,44 @@
+ break;
+
+ case '.':
+- if (pp == pathcomp) { /* nothing appended yet... */
++ if (pp == pathcomp) {
++ddot_hack:
++ /* nothing appended yet... */
+ if (*cp == '/') { /* don't bother appending "./" to */
+ ++cp; /* the path: skip behind the '/' */
+ break;
+- } else if (!uO.ddotflag && *cp == '.' && cp[1] == '/') {
+- /* "../" dir traversal detected */
+- cp += 2; /* skip over behind the '/' */
+- killed_ddot = TRUE; /* set "show message" flag */
+- break;
++ } else if (!uO.ddotflag) {
++
++ /*
++ * SECURITY: Skip past control characters if the user
++ * didn't OK use of absolute pathnames. lhh - this is
++ * a very quick, ugly, inefficient fix.
++ */
++ dp = cp;
++ do {
++ workch = (uch)(*dp);
++ if (workch == '/' && snarf_ddot) {
++ /* "../" dir traversal detected */
++ cp = dp + 1; /* skip past the '/' */
++ killed_ddot = TRUE; /* set "show msg" flag */
++ break;
++ } else if (workch == '.' && !snarf_ddot) {
++ snarf_ddot = TRUE;
++ } else if (isprint(workch) ||
++ ((workch > 127) && (workch <= 254))) {
++ /*
++ * Since we found a printable, non-ctrl char,
++ * we can stop looking for '../', the amount
++ * in ../!
++ */
++ break;
++ }
++
++ dp++;
++ } while (*dp != 0);
++
++ if (killed_ddot)
++ break;
+ }
+ }
+ *pp++ = '.';