wok diff busybox/stuff/busybox-1.28-unsafesymlink.u @ rev 20205
Up busybox (1.18.1)
author | Pascal Bellard <pascal.bellard@slitaz.org> |
---|---|
date | Tue Feb 20 18:10:43 2018 +0100 (2018-02-20) |
parents | |
children |
line diff
1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 1.2 +++ b/busybox/stuff/busybox-1.28-unsafesymlink.u Tue Feb 20 18:10:43 2018 +0100 1.3 @@ -0,0 +1,23 @@ 1.4 +skip unsafe_symlink_target check: avoid relative links in packages. 1.5 +--- busybox-1.28.1/archival/libarchive/data_extract_all.c 1.6 ++++ busybox-1.28.1/archival/libarchive/data_extract_all.c 1.7 +@@ -198,7 +198,7 @@ 1.8 + * 1.9 + * Untarring bug.tar would otherwise place evil.py in '/tmp'. 1.10 + */ 1.11 +- if (!unsafe_symlink_target(file_header->link_target)) { 1.12 ++ { 1.13 + res = symlink(file_header->link_target, dst_name); 1.14 + if (res != 0 1.15 + && !(archive_handle->ah_flags & ARCHIVE_EXTRACT_QUIET) 1.16 +--- busybox-1.28.1/archival/unzip.c 1.17 ++++ busybox-1.28.1/archival/unzip.c 1.18 +@@ -368,7 +368,7 @@ 1.19 + target[xstate.mem_output_size] = '\0'; 1.20 + #endif 1.21 + } 1.22 +- if (!unsafe_symlink_target(target)) { 1.23 ++ { 1.24 + //TODO: libbb candidate 1.25 + if (symlink(target, dst_fn)) { 1.26 + /* shared message */