diff options
| author | Guillem Jover <guillem@debian.org> | 2017-03-28 22:44:36 +0200 |
|---|---|---|
| committer | Guillem Jover <guillem@debian.org> | 2017-05-17 05:50:29 +0200 |
| commit | 8ba04d41c839318b5a024f6c5298848d3b54c723 (patch) | |
| tree | 38eca525d21ac56ca99ee75bbde270e39962d342 /scripts/Dpkg/Source | |
| parent | 068980536d9bf613cc0e0b6d17b49cc3e3b37313 (diff) | |
| download | dpkg-8ba04d41c839318b5a024f6c5298848d3b54c723.tar.gz | |
build: Detect the required GNU patch
This makes sure the perl module is using a directory traversal resistant
patch implementation, currently that's only GNU patch.
Fixes: CVE-2017-8283
Stable-Candidate: 1.17.x
Diffstat (limited to 'scripts/Dpkg/Source')
| -rw-r--r-- | scripts/Dpkg/Source/Patch.pm | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/scripts/Dpkg/Source/Patch.pm b/scripts/Dpkg/Source/Patch.pm index ee5e114f8..22e9d213d 100644 --- a/scripts/Dpkg/Source/Patch.pm +++ b/scripts/Dpkg/Source/Patch.pm @@ -30,6 +30,7 @@ use File::Compare; use Fcntl ':mode'; use Time::HiRes qw(stat); +use Dpkg; use Dpkg::Gettext; use Dpkg::ErrorHandling; use Dpkg::IPC; @@ -582,7 +583,7 @@ sub apply { $self->ensure_open('r'); my ($stdout, $stderr) = ('', ''); spawn( - exec => [ 'patch', @{$opts{options}} ], + exec => [ $Dpkg::PROGPATCH, @{$opts{options}} ], chdir => $destdir, env => { LC_ALL => 'C', LANG => 'C', PATCH_GET => '0' }, delete_env => [ 'POSIXLY_CORRECT' ], # ensure expected patch behaviour @@ -595,7 +596,7 @@ sub apply { if ($?) { print { *STDOUT } $stdout; print { *STDERR } $stderr; - subprocerr('LC_ALL=C patch ' . join(' ', @{$opts{options}}) . + subprocerr("LC_ALL=C $Dpkg::PROGPATCH " . join(' ', @{$opts{options}}) . ' < ' . $self->get_filename()); } $self->close(); @@ -632,7 +633,7 @@ sub check_apply { # Apply the patch $self->ensure_open('r'); my $patch_pid = spawn( - exec => [ 'patch', @{$opts{options}} ], + exec => [ $Dpkg::PROGPATCH, @{$opts{options}} ], chdir => $destdir, env => { LC_ALL => 'C', LANG => 'C', PATCH_GET => '0' }, delete_env => [ 'POSIXLY_CORRECT' ], # ensure expected patch behaviour @@ -642,7 +643,7 @@ sub check_apply { ); wait_child($patch_pid, nocheck => 1); my $exit = WEXITSTATUS($?); - subprocerr('patch --dry-run') unless WIFEXITED($?); + subprocerr("$Dpkg::PROGPATCH --dry-run") unless WIFEXITED($?); $self->close(); return ($exit == 0); } |