|
|
|
|
@ -1,7 +1,7 @@
|
|
|
|
|
From cdbc3fa8edc5b42391a5f2bfe1a8f6099929acf7 Mon Sep 17 00:00:00 2001
|
|
|
|
|
From 66854ee1d187095186ae718979baf771c177002a Mon Sep 17 00:00:00 2001
|
|
|
|
|
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
|
|
Date: Fri, 6 Jan 2023 12:50:48 -0800
|
|
|
|
|
Subject: [PATCH libXpm 5/6] Fix CVE-2022-4883: compression commands depend on
|
|
|
|
|
Subject: [PATCH libXpm 5/5] Fix CVE-2022-4883: compression commands depend on
|
|
|
|
|
$PATH
|
|
|
|
|
|
|
|
|
|
By default, on all platforms except MinGW, libXpm will detect if a
|
|
|
|
|
@ -18,17 +18,17 @@ privileges.
|
|
|
|
|
|
|
|
|
|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
|
|
|
---
|
|
|
|
|
README.md | 12 ++++++++++++
|
|
|
|
|
README | 12 ++++++++++++
|
|
|
|
|
configure.ac | 14 ++++++++++++++
|
|
|
|
|
src/RdFToI.c | 17 ++++++++++++++---
|
|
|
|
|
src/WrFFrI.c | 4 ++--
|
|
|
|
|
4 files changed, 42 insertions(+), 5 deletions(-)
|
|
|
|
|
|
|
|
|
|
diff --git a/README.md b/README.md
|
|
|
|
|
index f3f4c93..0b1c886 100644
|
|
|
|
|
--- a/README.md
|
|
|
|
|
+++ b/README.md
|
|
|
|
|
@@ -31,3 +31,15 @@ if it can't find the file it was asked to open. It relies on the
|
|
|
|
|
diff --git a/README b/README
|
|
|
|
|
index f532bef..c7d6dbf 100644
|
|
|
|
|
--- a/README
|
|
|
|
|
+++ b/README
|
|
|
|
|
@@ -38,3 +38,15 @@ if it can't find the file it was asked to open. It relies on the
|
|
|
|
|
--enable-open-zfile feature to open the file, and is enabled by default
|
|
|
|
|
when --enable-open-zfile is enabled, and can be disabled by passing the
|
|
|
|
|
--disable-stat-zfile flag to the configure script.
|
|
|
|
|
@ -45,10 +45,10 @@ index f3f4c93..0b1c886 100644
|
|
|
|
|
+the XPM_PATH_COMPRESS, XPM_PATH_UNCOMPRESS, XPM_PATH_GZIP, and XPM_PATH_GUNZIP
|
|
|
|
|
+variables to the configure command.
|
|
|
|
|
diff --git a/configure.ac b/configure.ac
|
|
|
|
|
index 85e2c73..4fc370d 100644
|
|
|
|
|
index 4a8d6de..c1da348 100644
|
|
|
|
|
--- a/configure.ac
|
|
|
|
|
+++ b/configure.ac
|
|
|
|
|
@@ -49,6 +49,14 @@ if test "x$USE_GETTEXT" = "xyes" ; then
|
|
|
|
|
@@ -48,6 +48,14 @@ if test "x$USE_GETTEXT" = "xyes" ; then
|
|
|
|
|
fi
|
|
|
|
|
AM_CONDITIONAL(USE_GETTEXT, test "x$USE_GETTEXT" = "xyes")
|
|
|
|
|
|
|
|
|
|
@ -63,7 +63,7 @@ index 85e2c73..4fc370d 100644
|
|
|
|
|
# Optional feature: When a filename ending in .Z or .gz is requested,
|
|
|
|
|
# open a pipe to a newly forked compress/uncompress/gzip/gunzip command to
|
|
|
|
|
# handle it.
|
|
|
|
|
@@ -64,6 +72,12 @@ AC_ARG_ENABLE(open-zfile,
|
|
|
|
|
@@ -63,6 +71,12 @@ AC_ARG_ENABLE(open-zfile,
|
|
|
|
|
AC_MSG_RESULT([$OPEN_ZFILE])
|
|
|
|
|
if test x$OPEN_ZFILE = xno ; then
|
|
|
|
|
AC_DEFINE(NO_ZPIPE, 1, [Define to 1 to disable decompression via pipes])
|
|
|
|
|
@ -123,10 +123,10 @@ index bd09611..a91d337 100644
|
|
|
|
|
else
|
|
|
|
|
#endif /* z-files */
|
|
|
|
|
diff --git a/src/WrFFrI.c b/src/WrFFrI.c
|
|
|
|
|
index 328c987..d59098f 100644
|
|
|
|
|
index 067c96b..bc38f66 100644
|
|
|
|
|
--- a/src/WrFFrI.c
|
|
|
|
|
+++ b/src/WrFFrI.c
|
|
|
|
|
@@ -342,10 +342,10 @@ OpenWriteFile(
|
|
|
|
|
@@ -336,10 +336,10 @@ OpenWriteFile(
|
|
|
|
|
#ifndef NO_ZPIPE
|
|
|
|
|
len = strlen(filename);
|
|
|
|
|
if (len > 2 && !strcmp(".Z", filename + (len - 2))) {
|
|
|
|
|
|
