Release v5.1.3

Signed-off-by: Allan McRae <allan@archlinux.org>

NEWS

@@ -1,5 +1,7 @@
 VERSION         DESCRIPTION
 -----------------------------------------------------------------------------
+5.1.3         - Sanitize file path received from Content-Disposition header
+                to fix potential arbitary code execution
 5.1.2         - pacman-conf: add missing DisableDownloadTimeout support
               - Include version when checking optdepend install status
                 during -Qi (FS#60106)

configure.ac

@@ -42,12 +42,12 @@ AC_PREREQ(2.64)
 #     pacman_version_micro += 1
 
 m4_define([lib_current], [11])
-m4_define([lib_revision], [2])
+m4_define([lib_revision], [3])
 m4_define([lib_age], [0])
 
 m4_define([pacman_version_major], [5])
 m4_define([pacman_version_minor], [1])
-m4_define([pacman_version_micro], [2])
+m4_define([pacman_version_micro], [3])
 m4_define([pacman_version],
           [pacman_version_major.pacman_version_minor.pacman_version_micro])
 

lib/libalpm/dload.c

@@ -534,7 +534,8 @@ static int curl_download_internal(struct dload_payload *payload,
 		if(payload->content_disp_name) {
 			/* content-disposition header has a better name for our file */
 			free(payload->destfile_name);
-			payload->destfile_name = get_fullpath(localpath, payload->content_disp_name, "");
+			payload->destfile_name = get_fullpath(localpath,
+				get_filename(payload->content_disp_name), "");
 		} else {
 			const char *effective_filename = strrchr(effective_url, '/');
 			if(effective_filename && strlen(effective_filename) > 2) {