* libtoolize.m4sh (func_copy_cb): Use tar chof to avoid symlink

attacks.
* libltdl/Makefile.am, libltdl/loaders/Makefile.am
(install-data-local): Ditto.

diff --git a/ChangeLog b/ChangeLog
index a17db56ffb51a7034323477270ebacaed42a3f9e..311dd47a5772c0fe15dbe56f2d7f412ac842250a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2005-03-02  Gary V. Vaughan  <gary@gnu.org>
+
+       * libtoolize.m4sh (func_copy_cb): Use tar chof to avoid symlink
+       attacks.
+       * libltdl/Makefile.am, libltdl/loaders/Makefile.am
+       (install-data-local): Ditto.
+
 2005-02-27  Gary V. Vaughan  <gary@gnu.org>
 
        In branch-2-0 (and in time, others) ltversion.m4 has a dot

diff --git a/libltdl/Makefile.am b/libltdl/Makefile.am
index b0ae282f3b1d14f5c7975603706491bf533d22b5..fc4734a275d40222abd5f17cd8d91ec28874f0ca 100644 (file)
--- a/libltdl/Makefile.am
+++ b/libltdl/Makefile.am
@@ -77,7 +77,7 @@ ltdldatafiles         = COPYING.LIB Makefile.am README configure.ac \
 ## with libtoolize, we have to preserve their timestamps carefully:
 install-data-local:
        $(mkinstalldirs) $(DESTDIR)$(ltdldatadir)
-       ( cd $(srcdir) && $(AMTAR) cf - $(ltdldatafiles); ) \
+       ( cd $(srcdir) && $(AMTAR) chof - $(ltdldatafiles); ) \
          | ( cd $(DESTDIR)$(ltdldatadir) && $(AMTAR) xf -; )
 
 ## Make sure these will be cleaned even when they're not built by default:

diff --git a/libltdl/loaders/Makefile.am b/libltdl/loaders/Makefile.am
index 4e732f951a6bb5b5d9682d7911c7298bbfd9092c..3e6947d84bf3c7414caf607139f59f0fbadc00d6 100644 (file)
--- a/libltdl/loaders/Makefile.am
+++ b/libltdl/loaders/Makefile.am
@@ -54,5 +54,5 @@ ltdldatafiles         = Makefile.am dld_link.c dlopen.c dyld.c \
 ## with libtoolize, we have to preserve their timestamps carefully:
 install-data-local:
        $(mkinstalldirs) $(DESTDIR)$(ltdldatadir)
-       ( cd $(srcdir) && $(AMTAR) cf - $(ltdldatafiles) preopen.c; ) \
+       ( cd $(srcdir) && $(AMTAR) chof - $(ltdldatafiles); ) \
          | ( cd $(DESTDIR)$(ltdldatadir) && $(AMTAR) xf -; )

diff --git a/libtoolize.m4sh b/libtoolize.m4sh
index 0bc5322432ce05c62856db9ab2db1388ae1d25a6..ad93a59dcc52747bd078435c1fac7ecd3c9b5ba6 100644 (file)
--- a/libtoolize.m4sh
+++ b/libtoolize.m4sh
@@ -242,7 +242,7 @@ func_copy_cb ()
     if $opt_link && $LN_S "$my_srcdir/$my_file" "$my_destdir/$my_file"; then
       $opt_quiet || func_echo "copying file \`$my_destdir/$my_file'"
       copy_return_status=0
-    elif { ( cd "$my_srcdir" && $TAR cf - "$my_file" 2>/dev/null; ) \
+    elif { ( cd "$my_srcdir" && $TAR chof - "$my_file" 2>/dev/null; ) \
         | ( cd "$my_destdir" && "$TAR" xf - > /dev/null 2>&1; ) } ; then
       $opt_quiet || func_echo "copying file \`$my_destdir/$my_file'"
       copy_return_status=0