Your message dated Thu, 24 Feb 2005 17:47:10 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#267596: fixed in mc 1:4.6.0-4.6.1-pre3-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 23 Aug 2004 14:52:44 +0000
>From [EMAIL PROTECTED] Mon Aug 23 07:52:44 2004
Return-path: <[EMAIL PROTECTED]>
Received: from ottolander.nl (mail.ottolander.nl) [213.239.197.111]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1BzGBf-0003bc-00; Mon, 23 Aug 2004 07:52:43 -0700
Received: from [192.168.0.3] (dslam135-41-166-62.adsl.zonnet.nl [62.166.41.135])
by mail.ottolander.nl (Postfix) with ESMTP id 3A99F3D77
for <[EMAIL PROTECTED]>; Mon, 23 Aug 2004 16:52:40 +0200 (CEST)
Subject: mc: CAN-2004-0494: Parameters to system/open calls unquoted in
extfs
From: Leonard den Ottolander <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Content-Type: multipart/mixed; boundary="=-uZ+K+8aJYnH5H94tsU/2"
Message-Id: <[EMAIL PROTECTED]>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.5 (1.4.5-7)
Date: Mon, 23 Aug 2004 16:52:40 +0200
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-3.3 required=4.0 tests=BAYES_40,HAS_PACKAGE,
REMOVE_REMOVAL_1WORD autolearn=no
version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level:
--=-uZ+K+8aJYnH5H94tsU/2
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Package: mc
Version: Every (4.6.0, 4.5.5)
The fact that parameters to system/open calls in vfs/extfs/deb.in are
not properly escaped was reported to Red Hat
(http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127973).
I've done a full audit of the files in vfs/extfs. 6 Files related to deb
packages were found vulnerable. mailfs.in, patchfs.in and uzip.in are
already properly quoted.
Fixes to deb.in and deba.in are already in upstream CVS. Fixes for a.in,
apt.in debd.in and dpkg.in, as well as some clean up of the previous
fixes will be in CVS soon.
Attached you find the full patch that should patch against 4.6.0 (and
probably 4.5.5) with -p1.
Leonard.
--
mount -t life -o ro /dev/dna /genetic/research
--=-uZ+K+8aJYnH5H94tsU/2
Content-Disposition: attachment; filename=extfs-quoted.patch
Content-Type: text/x-patch; name=extfs-quoted.patch; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
diff -up mc-4.6.0/vfs/extfs/a.in mc/vfs/extfs/a.in
--- mc-4.6.0/vfs/extfs/a.in 2002-12-11 21:57:00.000000000 +0100
+++ mc/vfs/extfs/a.in 2004-08-21 19:59:30.000000000 +0200
@@ -8,6 +8,13 @@
#
# These mtools components must be in PATH for this to work
+
+sub quote {
+ $_ = shift(@_);
+ s/([^\w\/.+-])/\\$1/g;
+ return($_);
+}
+
$mmd = "mmd";
$mrd = "mrd";
$mdel = "mdel";
@@ -15,7 +22,7 @@ $mdir = "mdir -a";
$mcopy = "mcopy -noQ";
$0 =~ s|.*/||;
-$disk = $0;
+$qdisk = quote($0);
$ENV{MTOOLS_DATE_STRING} = "mm-dd-yyyy";
$ENV{MTOOLS_TWENTY_FOUR_HOUR_CLOCK} = "1";
@@ -29,29 +36,36 @@ SWITCH: for ( $ARGV[0] ) {
/mkdir/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 1;
- system("$mmd $disk:/$ARGV[0] >/dev/null");
+ $qname = quote($ARGV[0]);
+ system("$mmd $qdisk:/$qname >/dev/null");
exit 0; };
/rmdir/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 1;
- system("$mrd $disk:/$ARGV[0] >/dev/null");
+ $qname = quote($ARGV[0]);
+ system("$mrd $qdisk:/$qname >/dev/null");
exit 0; };
/rm/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 1;
- system("$mdel $disk:/$ARGV[0] >/dev/null");
+ $qname = quote($ARGV[0]);
+ system("$mdel $qdisk:/$qname >/dev/null");
exit 0; };
/copyout/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 2;
- ( $src, $dest ) = @ARGV;
- system("$mcopy $disk:/$src $dest >/dev/null");
+ ( $qsrc, $qdest ) = @ARGV;
+ $qsrc = quote($qsrc);
+ $qdest = quote($qdest);
+ system("$mcopy $qdisk:/$qsrc $qdest >/dev/null");
exit 0; };
/copyin/ && do {
shift; shift;
exit 1 if scalar(@ARGV) != 2;
- ( $dest, $src ) = @ARGV;
- system("$mcopy $src $disk:/$dest >/dev/null");
+ ( $qdest, $qsrc ) = @ARGV;
+ $qsrc = quote($qsrc);
+ $qdest = quote($qdest);
+ system("$mcopy $qsrc $qdisk:/$qdest >/dev/null");
exit 0; };
/.*/ && do { # an unfamiliar command
exit 1; };
@@ -59,11 +73,11 @@ SWITCH: for ( $ARGV[0] ) {
sub get_dirs {
my ($path, $name, $size, $date, $time, $longname, @lst, @rv);
-
$path = shift(@_);
+ my $qpath = quote($path);
@rv = ();
- open(FILE,"$mdir $disk:/$path |");
+ open(FILE,"$mdir $qdisk:/$qpath |");
while ( <FILE> ) {
chomp();
/^ / && next; # ignore `non-file' lines
diff -up mc-4.6.0/vfs/extfs/apt.in mc/vfs/extfs/apt.in
--- mc-4.6.0/vfs/extfs/apt.in 2002-12-24 07:33:46.000000000 +0100
+++ mc/vfs/extfs/apt.in 2004-08-21 03:29:53.000000000 +0200
@@ -6,6 +6,12 @@
#
# apt
+sub quote {
+ $_ = shift(@_);
+ s/([^\w\/.+-])/\\$1/g;
+ return($_);
+}
+
sub bt
{
my ($dt) = @_;
@@ -229,14 +235,16 @@ sub list
sub copyout
{
my($archive,$filename) = @_;
+ my $qarchive = quote($archive);
+ my $qfilename = quote($filename);
if( $archive eq 'CHECK' ) {
- system("apt-get -q check > $filename");
+ system("apt-get -q check > $qfilename");
} elsif( $archive eq 'AVAILABLE' ) {
- system("apt-cache dumpavail > $filename");
+ system("apt-cache dumpavail > $qfilename");
} elsif( $archive eq 'STATS' ) {
- system("apt-cache stats > $filename");
+ system("apt-cache stats > $qfilename");
} elsif( $archive eq 'CONFIG' ) {
- system("(apt-config dump 2>&1) > $filename");
+ system("(apt-config dump 2>&1) > $qfilename");
} elsif( $archive eq 'UPDATE' ) {
open O, ">$filename";
print O $pressupdate;
@@ -246,12 +254,12 @@ sub copyout
print O $pressupgrade;
close O;
} elsif( $archive eq 'apt.conf' ) {
- system("cp /etc/apt/apt.conf $filename");
+ system("cp /etc/apt/apt.conf $qfilename");
} elsif( $archive eq 'sources.list' ) {
- system("cp /etc/apt/sources.list $filename");
+ system("cp /etc/apt/sources.list $qfilename");
} elsif( $archive =~ /^CACHE\// ) {
$archive =~ s%^CACHE/%/var/cache/apt/archives/%;
- system("cp $archive $filename");
+ system("cp $qarchive $qfilename");
} else {
open O, ">$filename";
print O $archive, "\n";
@@ -262,15 +270,17 @@ sub copyout
sub copyin
{
my($archive,$filename) = @_;
+ my $qarchive = quote($archive);
+ my $qfilename = quote($filename);
if( $archive =~ /\.deb$/ ) {
- system("dpkg -i $filename>/dev/null");
+ system("dpkg -i $qfilename>/dev/null");
} elsif( $archive eq 'apt.conf' ) {
- system("cp $filename /etc/apt/apt.conf");
+ system("cp $qfilename /etc/apt/apt.conf");
} elsif( $archive eq 'sources.list' ) {
- system("cp $filename /etc/apt/sources.list");
+ system("cp $qfilename /etc/apt/sources.list");
} elsif( $archive =~ /^CACHE\// ) {
- $archive =~ s%^CACHE/%/var/cache/apt/archives/%;
- system("cp $filename $archive");
+ $qarchive =~ s%^CACHE/%/var/cache/apt/archives/%;
+ system("cp $qfilename $qarchive");
} else {
die "extfs: cannot create regular file \`$archive\': Permission
denied\n";
}
@@ -293,19 +303,20 @@ sub run
sub rm
{
my($archive) = @_;
+ my $qarchive = quote($archive);
if( $archive =~ /^CACHE\// ) {
- $archive =~ s%^CACHE/%/var/cache/apt/archives/%;
- system("rm -f $archive");
+ $qarchive =~ s%^CACHE/%/var/cache/apt/archives/%;
+ system("rm -f $qarchive");
} elsif( $archive eq 'apt.conf' ) {
system("rm -f /etc/apt/apt.conf");
} elsif( $archive eq 'sources.list' ) {
system("rm -f /etc/apt/sources.list");
} elsif( $archive =~ /\.debd?$/ ) {
# uncommented and changed to use dpkg - alpha
- my $name = $archive;
- $name =~ s%.*/%%g;
- $name =~ s%_.*%%g;
- system("dpkg --remove $name >/dev/null");
+ my $qname = $qarchive;
+ $qname =~ s%.*/%%g;
+ $qname =~ s%_.*%%g;
+ system("dpkg --remove $qname >/dev/null");
die("extfs: $archive: Operation not permitted\n") if $? != 0;
} else {
die "extfs: $archive: Operation not permitted\n";
diff -up mc-4.6.0/vfs/extfs/deba.in mc/vfs/extfs/deba.in
--- mc-4.6.0/vfs/extfs/deba.in 2002-12-12 17:15:30.000000000 +0100
+++ mc/vfs/extfs/deba.in 2004-08-21 03:30:36.000000000 +0200
@@ -6,111 +6,25 @@
#
# deba
-sub bt
-{
- my ($dt) = @_;
- my (@time);
- @time = localtime($dt);
- $bt = sprintf "%02d-%02d-%d %02d:%02d", $time[4] + 1, $time[3],
- $time[5] + 1900, $time[2], $time[1];
- return $bt;
-}
-
-
-sub ft
-{
- my ($f) = @_;
- return "d" if -d $f;
- return "l" if -l $f;
- return "p" if -p $f;
- return "S" if -S $f;
- return "b" if -b $f;
- return "c" if -c $f;
- return "-";
-}
-
-sub fm
-{
- my ($n) = @_;
- my ($m);
-
- if( $n & 0400 ) {
- $m .= "r";
- } else {
- $m .= "-";
- }
- if( $n & 0200 ) {
- $m .= "w";
- } else {
- $m .= "-";
- }
- if( $n & 04000 ) {
- $m .= "s";
- } elsif( $n & 0100 ) {
- $m .= "x";
- } else {
- $m .= "-";
- }
-
- if( $n & 0040 ) {
- $m .= "r";
- } else {
- $m .= "-";
- }
- if( $n & 0020 ) {
- $m .= "w";
- } else {
- $m .= "-";
- }
- if( $n & 02000 ) {
- $m .= "s";
- } elsif( $n & 0010 ) {
- $m .= "x";
- } else {
- $m .= "-";
- }
-
- if( $n & 0004 ) {
- $m .= "r";
- } else {
- $m .= "-";
- }
- if( $n & 0002 ) {
- $m .= "w";
- } else {
- $m .= "-";
- }
- if( $n & 01000 ) {
- $m .= "t";
- } elsif( $n & 0001 ) {
- $m .= "x";
- } else {
- $m .= "-";
- }
-
- return $m;
-}
-
-sub ls {
- my ($file) = @_;
- my @stat = stat($file);
- # mode, nlink, uid, gid, size, mtime, filename
- printf "%s%s %d %d %d %d %s CONTENTS%s\n", ft($file), fm($stat[2] & 07777),
- $stat[3], $stat[4], $stat[5], $stat[7], bt($stat[9]), $file;
+sub quote {
+ $_ = shift(@_);
+ s/([^\w\/.+-])/\\$1/g;
+ return($_);
}
sub list
{
- my($archive)[EMAIL PROTECTED];
+ my($qarchive)[EMAIL PROTECTED];
+ $qarchive = quote($qarchive);
chop($date=`LC_ALL=C date "+%b %d %Y %H:%M"`);
- chop($info_size=`apt-cache show $archive | wc -c`);
+ chop($info_size=`apt-cache show $qarchive | wc -c`);
$install_size=length($pressinstall);
$upgrade_size=length($pressupgrade);
print "-r--r--r-- 1 root root $info_size $date INFO\n";
- chop($debd = `dpkg -s $archive | grep -i ^Version | sed 's/^version:
//i'`);
- chop($deba = `apt-cache show $archive | grep -i ^Version | sed
's/^version: //i'`);
+ chop($debd = `dpkg -s $qarchive | grep -i ^Version | sed 's/^version:
//i'`);
+ chop($deba = `apt-cache show $qarchive | grep -i ^Version | sed
's/^version: //i'`);
if( ! $debd ) {
print "-r-xr--r-- 1 root root $install_size $date
INSTALL\n";
} elsif( $debd ne $deba ) {
@@ -121,20 +35,21 @@ sub list
sub copyout
{
my($archive,$filename,$destfile)[EMAIL PROTECTED];
-
+ my $qarchive = quote($archive);
+ my $qdestfile = quote($destfile);
if($filename eq "INFO") {
- system("apt-cache show $archive > $destfile");
+ system("apt-cache show $qarchive > $qdestfile");
} elsif($filename eq "INSTALL") {
- if ( open(FILEOUT,">$destfile") ) {
+ if ( open(FILEOUT, "> $destfile") ) {
print FILEOUT $pressinstall;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
} elsif($filename eq "UPGRADE") {
- if ( open(FILEOUT,">$destfile") ) {
+ if ( open(FILEOUT, ">, $destfile") ) {
print FILEOUT $pressupgrade;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
} else {
die "extfs: $filename: No such file or directory\n";
@@ -144,10 +59,11 @@ sub copyout
sub run
{
my($archive,$filename)[EMAIL PROTECTED];
+ my $qarchive = quote($archive);
if($filename eq "INSTALL") {
- system("apt-get install $archive");
+ system("apt-get install $qarchive");
} elsif($filename eq "UPGRADE") {
- system("apt-get install $archive");
+ system("apt-get install $qarchive");
} else {
die "extfs: $filename: Permission denied\n";
}
diff -up mc-4.6.0/vfs/extfs/debd.in mc/vfs/extfs/debd.in
--- mc-4.6.0/vfs/extfs/debd.in 2002-12-12 17:15:30.000000000 +0100
+++ mc/vfs/extfs/debd.in 2004-08-21 03:39:44.000000000 +0200
@@ -6,6 +6,12 @@
#
# debd
+sub quote {
+ $_ = shift(@_);
+ s/([^\w\/.+-])/\\$1/g;
+ return($_);
+}
+
sub bt
{
my ($dt) = @_;
@@ -102,8 +108,9 @@ sub ls {
sub list
{
my($archive)[EMAIL PROTECTED];
+ my $qarchive = quote($archive);
chop($date=`LC_ALL=C date "+%b %d %Y %H:%M"`);
- chop($info_size=`dpkg -s $archive | wc -c`);
+ chop($info_size=`dpkg -s $qarchive | wc -c`);
$repack_size=length($pressrepack);
$reinstall_size=length($pressreinstall);
$remove_size=length($pressremove);
@@ -118,7 +125,7 @@ sub list
print "-r--r--r-- 1 root root $info_size $date INFO\n";
print "-r-xr--r-- 1 root root $purge_size $date DPKG-PURGE\n";
- chop($status = `dpkg -s $archive | grep ^Status`);
+ chop($status = `dpkg -s $qarchive | grep ^Status`);
if( $status =~ /deinstall/ ) {
print "-r-xr--r-- 1 root root $select_size $date
DPKG-SELECT\n";
} elsif( $status =~ /install/ ) {
@@ -141,7 +148,7 @@ sub list
- if ( open(PIPEIN, "LANG=C ls -l /var/lib/dpkg/info/$archive.* |") ) {
+ if ( open(PIPEIN, "LANG=C ls -l /var/lib/dpkg/info/$qarchive.* |") ) {
while(<PIPEIN>) {
chop;
next if /\.list$/;
@@ -163,35 +170,38 @@ sub list
sub copyout
{
my($archive,$filename,$destfile)[EMAIL PROTECTED];
+ my $qarchive = quote($archive);
+ my $qfilename = quote($filename);
+ my $qdestfile = quote($destfile);
if($filename eq "INFO") {
- system("dpkg -s $archive > $destfile");
+ system("dpkg -s $qarchive > $qdestfile");
} elsif($filename eq "DPKG-REPACK") {
if ( open(FILEOUT,">$destfile") ) {
print FILEOUT $pressrepack;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
} elsif($filename =~ /^DEBIAN/) {
$filename=~s!^DEBIAN/!!;
- system("cat /var/lib/dpkg/info/$archive.$filename > $destfile");
+ system("cat /var/lib/dpkg/info/$qarchive.$qfilename > $qdestfile");
} elsif($filename eq "DPKG-REMOVE" || $filename eq "APT-REMOVE") {
if ( open(FILEOUT,">$destfile") ) {
print FILEOUT $pressremove;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
} elsif($filename eq "DPKG-PURGE" || $filename eq "APT-PURGE") {
if ( open(FILEOUT,">$destfile") ) {
print FILEOUT $presspurge;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
} elsif($filename eq "DPKG-RECONFIGURE") {
if ( open(FILEOUT,">$destfile") ) {
print FILEOUT $pressreconfigure;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
} elsif($filename eq "APT-REINSTALL") {
if ( open(FILEOUT,">$destfile") ) {
@@ -209,41 +219,43 @@ sub copyout
if ( open(FILEOUT,">$destfile") ) {
print FILEOUT $pressunselect;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
} else {
- $filename=~s!^CONTENTS!!;
- system("cat $filename > $destfile");
+ $qfilename=~s!^CONTENTS!!;
+ system("cat $qfilename > $qdestfile");
}
}
sub run
{
my($archive,$filename)[EMAIL PROTECTED];
+ my $qarchive = quote($archive);
+ my $qfilename = quote($filename);
if($filename eq "DPKG-REMOVE") {
- system("dpkg --remove $archive");
+ system("dpkg --remove $qarchive");
} elsif($filename eq "APT-REMOVE") {
- system("apt-get remove $archive");
+ system("apt-get remove $qarchive");
} elsif($filename eq "DPKG-PURGE") {
- system("dpkg --purge $archive");
+ system("dpkg --purge $qarchive");
} elsif($filename eq "APT-PURGE") {
- system("apt-get --purge remove $archive");
+ system("apt-get --purge remove $qarchive");
} elsif($filename eq "DPKG-REPACK") {
- system("dpkg-repack $archive");
+ system("dpkg-repack $qarchive");
} elsif($filename eq "DPKG-SELECT") {
- system("echo $archive install | dpkg --set-selections");
+ system("echo $aqrchive install | dpkg --set-selections");
} elsif($filename eq "DPKG-UNSELECT") {
- system("echo $archive deinstall | dpkg --set-selections");
+ system("echo $qarchive deinstall | dpkg --set-selections");
} elsif($filename eq "APT-REINSTALL") {
- system("apt-get -u --reinstall install $archive");
+ system("apt-get -u --reinstall install $qarchive");
} elsif($filename eq "DPKG-RECONFIGURE") {
- system("dpkg-reconfigure $archive");
+ system("dpkg-reconfigure $qarchive");
} elsif($filename=~/^DEBIAN/) {
$filename=~s!^DEBIAN!!;
- system("/var/lib/dpkg/info/$archive.$filename");
+ system("/var/lib/dpkg/info/$qarchive.$qfilename");
} else {
- $filename=~s!^CONTENTS!!;
- system($filename);
+ $qfilename=~s!^CONTENTS!!;
+ system($qfilename);
}
}
diff -up mc-4.6.0/vfs/extfs/deb.in mc/vfs/extfs/deb.in
--- mc-4.6.0/vfs/extfs/deb.in 2004-08-19 19:58:31.000000000 +0200
+++ mc/vfs/extfs/deb.in 2004-08-21 03:44:59.000000000 +0200
@@ -19,6 +19,12 @@
# Copyright (C) 1997 Free Software Foundation
#
+sub quote {
+ $_ = shift(@_);
+ s/([^\w\/.+-])/\\$1/g;
+ return($_);
+}
+
sub mcdebfs_list
{
#
@@ -26,8 +32,9 @@ sub mcdebfs_list
# Empty directories do not appear at all
#
local($archivename)[EMAIL PROTECTED];
+ local $qarchivename = quote($archivename);
chop($date=`LC_ALL=C date "+%b %d %Y %H:%M"`);
- chop($info_size=`dpkg -I $archivename | wc -c`);
+ chop($info_size=`dpkg -I $qarchivename | wc -c`);
$install_size=length($pressinstall);
print "dr-xr-xr-x 1 root root 0 $date CONTENTS\n";
@@ -36,7 +43,7 @@ sub mcdebfs_list
print "-r--r--r-- 1 root root $info_size $date INFO\n";
print "-r-xr--r-- 1 root root $install_size $date INSTALL\n";
- if ( open(PIPEIN, "dpkg-deb -c $archivename |") )
+ if ( open(PIPEIN, "dpkg-deb -c $qarchivename |") )
{
while(<PIPEIN>)
{
@@ -81,7 +88,7 @@ sub mcdebfs_list
}
}
# begin from Patrik Rak
- if ( open(PIPEIN, "dpkg-deb -I $archivename |") )
+ if ( open(PIPEIN, "dpkg-deb -I $qarchivename |") )
{
while(<PIPEIN>)
{
@@ -109,16 +116,19 @@ sub mcdebfs_list
sub mcdebfs_copyout
{
local($archive,$filename,$destfile)[EMAIL PROTECTED];
+ local $qarchive = quote($archive);
+ local $qfilename = quote($filename);
+ local $qdestfile = quote($destfile);
if($filename eq "INFO")
{
- system("dpkg-deb -I $archive > $destfile");
+ system("dpkg-deb -I $qarchive > $qdestfile");
# begin from Patrik Rak
}
elsif($filename =~ /^DEBIAN/)
{
- $filename=~s!^DEBIAN/!!;
- system("dpkg-deb -I $archive $filename > $destfile");
+ $qfilename=~s!^DEBIAN/!!;
+ system("dpkg-deb -I $qarchive $qfilename > $qdestfile");
# end from Patrik Rak
}
@@ -128,24 +138,25 @@ sub mcdebfs_copyout
{
print FILEOUT $pressinstall;
close FILEOUT;
- system("chmod a+x $destfile");
+ system("chmod a+x $qdestfile");
}
}
else
{
# files can be prepended with ./ or not, depending on the version of tar
- $filename=~s!^CONTENTS/!!;
- system("dpkg-deb --fsys-tarfile $archive | tar xOf - $filename
./$filename > $destfile 2>/dev/null");
+ $qfilename=~s!^CONTENTS/!!;
+ system("dpkg-deb --fsys-tarfile $qarchive | tar xOf -
$qfilename ./$qfilename > $qdestfile 2>/dev/null");
}
}
sub mcdebfs_run
{
local($archive,$filename)[EMAIL PROTECTED];
+ local $qarchive = quote($archive);
if($filename eq "INSTALL")
{
print "Installing $archive\n";
- system("dpkg -i $archive");
+ system("dpkg -i $qarchive");
}
else
{
diff -up mc-4.6.0/vfs/extfs/dpkg.in mc/vfs/extfs/dpkg.in
--- mc-4.6.0/vfs/extfs/dpkg.in 2002-12-24 07:33:46.000000000 +0100
+++ mc/vfs/extfs/dpkg.in 2004-08-21 03:48:28.000000000 +0200
@@ -6,6 +6,12 @@
#
# dpkg
+sub quote {
+ $_ = shift(@_);
+ s/([^\w\/.+-])/\\$1/g;
+ return($_);
+}
+
sub bt
{
my ($dt) = @_;
@@ -183,20 +189,21 @@ sub list
sub copyout
{
my($archive,$filename) = @_;
+ my $qfilename = quote($filename);
if( $archive eq 'DIVERSIONS' ) {
- system("dpkg-divert --list > $filename 2>/dev/null");
+ system("dpkg-divert --list > $qfilename 2>/dev/null");
} elsif( $archive eq 'ARCHITECTURE' ) {
- system("dpkg-architecture > $filename 2>/dev/null");
+ system("dpkg-architecture > $qfilename 2>/dev/null");
} elsif( $archive eq 'LIST' ) {
- system("dpkg -l '*' > $filename 2>/dev/null");
+ system("dpkg -l '*' > $qfilename 2>/dev/null");
} elsif( $archive eq 'AUDIT' ) {
- system("dpkg --audit > $filename 2>/dev/null");
+ system("dpkg --audit > $qfilename 2>/dev/null");
} elsif( $archive eq 'GET-SELECTIONS' ) {
- system("dpkg --get-selections > $filename 2>/dev/null");
+ system("dpkg --get-selections > $qfilename 2>/dev/null");
} elsif( $archive eq 'STATUS' ) {
- system("cp /var/lib/dpkg/status $filename");
+ system("cp /var/lib/dpkg/status $qfilename");
} elsif( $archive eq 'AVAILABLE' ) {
- system("cp /var/lib/dpkg/available $filename");
+ system("cp /var/lib/dpkg/available $qfilename");
} elsif( $archive eq 'CONFIGURE' ) {
open O, ">$filename";
print O $pressconfigure;
@@ -224,8 +231,9 @@ sub copyout
sub copyin
{
my($archive,$filename) = @_;
+ my $qfilename = quote($filename);
if( $archive =~ /\.deb$/ ) {
- system("dpkg -i $filename>/dev/null");
+ system("dpkg -i $qfilename>/dev/null");
} else {
die "extfs: cannot create regular file \`$archive\': Permission
denied\n";
}
@@ -252,12 +260,12 @@ sub rm_disabled
{
my($archive) = @_;
if( $archive =~ /\.debd?$/ ) {
- my $name = $archive;
- $name =~ s%.*/%%g;
- $name =~ s%_.*%%g;
- system("if dpkg -s $name | grep ^Status | grep -qs config-files; \
- then dpkg --purge $name>/dev/null; \
- else dpkg --remove $name>/dev/null; fi");
+ my $qname = quote($archive);
+ $qname =~ s%.*/%%g;
+ $qname =~ s%_.*%%g;
+ system("if dpkg -s $qname | grep ^Status | grep -qs config-files; \
+ then dpkg --purge $qname>/dev/null; \
+ else dpkg --remove $qname>/dev/null; fi");
die("extfs: $archive: Operation not permitted\n") if $? != 0;
} else {
die "extfs: $archive: Operation not permitted\n";
--=-uZ+K+8aJYnH5H94tsU/2--
---------------------------------------
Received: (at 267596-close) by bugs.debian.org; 24 Feb 2005 22:55:37 +0000
>From [EMAIL PROTECTED] Thu Feb 24 14:55:37 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D4RtR-0001zD-00; Thu, 24 Feb 2005 14:55:37 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1D4RlG-0002Um-00; Thu, 24 Feb 2005 17:47:10 -0500
From: Ludovic Drolez <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#267596: fixed in mc 1:4.6.0-4.6.1-pre3-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Thu, 24 Feb 2005 17:47:10 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 6
Source: mc
Source-Version: 1:4.6.0-4.6.1-pre3-1
We believe that the bug you reported is fixed in the latest version of
mc, which is due to be installed in the Debian FTP archive:
mc_4.6.0-4.6.1-pre3-1.diff.gz
to pool/main/m/mc/mc_4.6.0-4.6.1-pre3-1.diff.gz
mc_4.6.0-4.6.1-pre3-1.dsc
to pool/main/m/mc/mc_4.6.0-4.6.1-pre3-1.dsc
mc_4.6.0-4.6.1-pre3-1_i386.deb
to pool/main/m/mc/mc_4.6.0-4.6.1-pre3-1_i386.deb
mc_4.6.0-4.6.1-pre3.orig.tar.gz
to pool/main/m/mc/mc_4.6.0-4.6.1-pre3.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ludovic Drolez <[EMAIL PROTECTED]> (supplier of updated mc package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 17 Feb 2005 22:45:32 +0100
Source: mc
Binary: mc
Architecture: source i386
Version: 1:4.6.0-4.6.1-pre3-1
Distribution: unstable
Urgency: high
Maintainer: Stefano Melchior <[EMAIL PROTECTED]>
Changed-By: Ludovic Drolez <[EMAIL PROTECTED]>
Description:
mc - midnight commander - a powerful file manager
Closes: 92121 231071 241891 267596 282301 286395 295259 295261
Changes:
mc (1:4.6.0-4.6.1-pre3-1) unstable; urgency=high
.
* New maintainers: Stefano Melchior and Ludovic Drolez (closes: #282301).
* Urgency set to high because of security bug fixes.
* Missing quoting in ext2 and i18n fix.
* Samba lib warning (netmask.c) fixed.
* Security upload to handle DSA 639 (references: CAN-2004-1004,
CAN-2004-1005, CAN-2004-1009, CAN-2004-1090, CAN-2004-1091, CAN-2004-1092,
CAN-2004-1093, CAN-2004-1174, CAN-2004-1175, CAN-2004-1176),
Fixed upstream in the pre3 release (Closes: #295261).
* Pre3 release includes fix for CAN-2004-0226 (closes: #286395).
* Fixed ftp filesystem impossibility to list dirs when password contains #
(closes: #92121).
* Fixed subshell impossibility to be started (closes: #241891).
* Fixed CAN-2004-0494 (closes: #267596).
* Fixed buffer overflow and format string vulnerabilities (closes: #295259).
* Italian hotkey translation changed (closes: #231071).
* New upstream pre-release.
Files:
c8e34240a29a723bc78bdd85463a26f3 691 utils optional mc_4.6.0-4.6.1-pre3-1.dsc
2bea7e3250efa665d972229e755ac1e6 3900927 utils optional
mc_4.6.0-4.6.1-pre3.orig.tar.gz
8c8a3a55fdb76c3105a564e037f06022 25254 utils optional
mc_4.6.0-4.6.1-pre3-1.diff.gz
3a6752d5079f576910f291bd752960c8 2003694 utils optional
mc_4.6.0-4.6.1-pre3-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFCHlNlsRlQAP1GppgRAim8AJwJRGe3QLax1XUU1NmZ35R1TsN4PQCfY8k2
LZo2XB/RBba9ZXrH7kMF12M=
=WFw5
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
