Hi,
attached is a patch for an issue reported in the Subversion issue tracker as
issue 1869:
http://subversion.tigris.org/issues/show_bug.cgi?id=1869
The issue is that merging two paths "" and "..\..\.." with the
apr_filepath_merge functions returns a result of "..\" where it obviously
should have returned "..\..\..".
Attached patch will solve that issue. I included a new unit test to test for
this issue.
When replying, please include my email address in CC as I'm not subscribed
to this list.
kind regards,
Lieven.
Index: file_io/win32/filepath.c
===================================================================
--- file_io/win32/filepath.c (revision 422522)
+++ file_io/win32/filepath.c (working copy)
@@ -673,7 +673,7 @@
*/
}
else if (pathlen == 0 ||
- (pathlen >= 3 && (pathlen == 3
+ (pathlen >= 3 && (pathlen % 3 == 0
|| path[pathlen - 4] == ':')
&& path[pathlen - 3] == '.'
&& path[pathlen - 2] == '.'
Index: test/testnames.c
===================================================================
--- test/testnames.c (revision 422522)
+++ test/testnames.c (working copy)
@@ -91,6 +91,18 @@
ABTS_STR_EQUAL(tc, "../test", dstpath);
}
+static void merge_dotdot_dotdot_dotdot(abts_case *tc, void *data)
+{
+ apr_status_t rv;
+ char *dstpath = NULL;
+
+ rv = apr_filepath_merge(&dstpath, "",
+ "../../../", APR_FILEPATH_TRUENAME, p);
+ ABTS_PTR_NOTNULL(tc, dstpath);
+ ABTS_INT_EQUAL(tc, APR_SUCCESS, rv);
+ ABTS_STR_EQUAL(tc, "../../../", dstpath);
+}
+
static void merge_secure(abts_case *tc, void *data)
{
apr_status_t rv;
@@ -249,6 +261,7 @@
abts_run_test(suite, merge_notrelfail, NULL);
abts_run_test(suite, merge_notabs, NULL);
abts_run_test(suite, merge_notabsfail, NULL);
+ abts_run_test(suite, merge_dotdot_dotdot_dotdot, NULL);
abts_run_test(suite, root_absolute, NULL);
abts_run_test(suite, root_relative, NULL);
