Release v5.1.3

Signed-off-by: Allan McRae <allan@archlinux.org>
Sanitize file name received from Content-Disposition header
2019-03-01 11:28:53 +10:00 · 2019-03-01 11:25:46 +10:00
3 changed files with 6 additions and 3 deletions
--- a/2
+++ b/2
@@ -1,5 +1,7 @@
 VERSION         DESCRIPTION
 -----------------------------------------------------------------------------
+5.1.3         - Sanitize file path received from Content-Disposition header
+                to fix potential arbitary code execution
 5.1.2         - pacman-conf: add missing DisableDownloadTimeout support
              - Include version when checking optdepend install status
                during -Qi (FS#60106)
--- a/configure.ac
+++ b/configure.ac
@@ -42,12 +42,12 @@ AC_PREREQ(2.64)
 #     pacman_version_micro += 1

 m4_define([lib_current], [11])
-m4_define([lib_revision], [2])
+m4_define([lib_revision], [3])
 m4_define([lib_age], [0])

 m4_define([pacman_version_major], [5])
 m4_define([pacman_version_minor], [1])
-m4_define([pacman_version_micro], [2])
+m4_define([pacman_version_micro], [3])
 m4_define([pacman_version],
          [pacman_version_major.pacman_version_minor.pacman_version_micro])

--- a/lib/libalpm/dload.c
+++ b/lib/libalpm/dload.c
@@ -534,7 +534,8 @@ static int curl_download_internal(struct dload_payload *payload,
 		if(payload->content_disp_name) {
 			/* content-disposition header has a better name for our file */
 			free(payload->destfile_name);
-			payload->destfile_name = get_fullpath(localpath, payload->content_disp_name, "");
+			payload->destfile_name = get_fullpath(localpath,
+				get_filename(payload->content_disp_name), "");
 		} else {
 			const char *effective_filename = strrchr(effective_url, '/');
 			if(effective_filename && strlen(effective_filename) > 2) {