From 6f6864df139cce4ef347abbf862d6ff401b23c7d Mon Sep 17 00:00:00 2001 From: Sergey Poznyakoff Date: Wed, 3 Oct 2007 20:18:32 +0000 Subject: [PATCH] (try_purge_directory): Ensure that arguments to T and R are safe. --- src/incremen.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/incremen.c b/src/incremen.c index 50be010..bc5fdad 100644 --- a/src/incremen.c +++ b/src/incremen.c @@ -1410,6 +1410,19 @@ try_purge_directory (char const *directory_name) arc += strlen (arc) + 1; dst = arc + 1; + /* Ensure that neither source nor destination are absolute file + names (unless permitted by -P option), and that they do not + contain dubious parts (e.g. ../). + + This is an extra safety precaution. Besides, it might be + necessary to extract from archives created with tar versions + prior to 1.19. */ + + if (*src) + src = safer_name_suffix (src, false, absolute_names_option); + if (*dst) + dst = safer_name_suffix (dst, false, absolute_names_option); + if (*src == 0) src = temp_stub; else if (*dst == 0) -- 2.44.0