CVSROOT: /cvs Module name: src Changes by: [email protected] 2026/08/27 21:56:19
Modified files:
usr.sbin/fw_update: fw_update.sh
Log message:
fw_update could be tricked into treating the untrusted comment as data.
In some situations (-a) this could be passed into fetch(), which did not
validate what it passed to su(1). Use the trusted output of signify and
add stricter validation.
with & ok afresh1@
