Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.debian.kernel > #67460 > unrolled thread

Bug#964234: dpkg-source: Considers missing symlink targets directory traversals

Started byGuillem Jover <guillem@debian.org>
First post2020-07-04 07:10 +0200
Last post2020-07-04 07:10 +0200
Articles 1 — 1 participant

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.


Contents

  Bug#964234: dpkg-source: Considers missing symlink targets directory traversals Guillem Jover <guillem@debian.org> - 2020-07-04 07:10 +0200

#67460 — Bug#964234: dpkg-source: Considers missing symlink targets directory traversals

FromGuillem Jover <guillem@debian.org>
Date2020-07-04 07:10 +0200
SubjectBug#964234: dpkg-source: Considers missing symlink targets directory traversals
Message-ID<AoIB3-5rt-3@gated-at.bofh.it>
Control: reassign -1 dpkg-dev
Control: retitle -1 dpkg-source: Considers missing symlink targets directory traversals
Control: found -1 1.20.0

On Sat, 2020-07-04 at 01:20:18 +0200, Andreas Beckmann wrote:
> Source: dpkg,firmware-nonfree
> Version: 20190717-2
> Severity: serious
> Tags: ftbfs
> Justification: fails to build from source
> Control: found -1 20190717-2
> Control: found -1 1.20.3

> src:firmware-nonfree fails to unpack in sid with latest dpkg:
> 
> dpkg-source: info: extracting firmware-nonfree in firmware-nonfree-20190717
> dpkg-source: info: unpacking firmware-nonfree_20190717.orig.tar.xz
> dpkg-source: info: unpacking firmware-nonfree_20190717-2.debian.tar.xz
> dpkg-source: info: using patch list from debian/patches/series
> dpkg-source: info: applying gitignore.patch
> Use of uninitialized value $canon_pathname in pattern match (m//) at /usr/share/perl5/Dpkg/Source/Package.pm line 550.
> dpkg-source: error: pathname 'firmware-nonfree-20190717/debian/config/libertas/sd8688_helper.bin' points outside source root
> 
> Since this could also be a dpkg error (see the perl warning before the failure)
> I'm assigning this bug to both packages, please reassign as appropriate.

It is, the pathname above is a symlink to a missing target, which is
definitely not a directory traversal attempt. I'm fixing this now, and
will upload tomorrow.

Thanks,
Guillem

[toc] | [standalone]


Back to top | Article view | linux.debian.kernel


csiph-web