Zoltan Hidvegi wrote: > More info: this is not an upstream issue, it's caused by the > handle-removed-working-dir.patch which is an attempt to fix > #667038. Besides chopping off the last path component of any cd > ../name command, it also does sfprintf(shp->strbuf,oldpwd) which is a > problem if oldpwd contains printf formatting escapes, which probably > could be exploited. Workaround is to remove > handle-removed-working-dir.patch which would then reopen #667038.
The patch was received from upstream. There's just been a new upstream release which resolves both issues. So either the patch I got from upstream relied on other changes since the release or the second issue was found and fixed later. Anyway, I've prepared a package of the new release and depending on how busy my sponsor is it'll hopefully be uploaded before long. Oliver -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
