* libtoolize.m4sh (func_copy_cb): Use tar chof to avoid symlink

attacks.
* libltdl/Makefile.am (install-data-local): Ditto.

diff --git a/ChangeLog b/ChangeLog
index 108268f3cab7232d5effb628209d68978c05dd17..f1c8fda73e377300adcd4be150d25f95e4f11eb0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,13 @@
+2005-03-02  Gary V. Vaughan  <gary@gnu.org>
+
+       * libtoolize.m4sh (func_copy_cb): Use tar chof to avoid symlink
+       attacks.
+       * libltdl/Makefile.am (install-data-local): Ditto.
+
 2005-02-24  Peter O'Gorman  <peter@pogma.com>
 
-       * libtool.m4 (AC_LIBTOOL_PROG_LD_SHLIBS): The Portland group's 
-       compiler does not pass --whole-archive. Move gnu ld check for 
+       * libtool.m4 (AC_LIBTOOL_PROG_LD_SHLIBS): The Portland group's
+       compiler does not pass --whole-archive. Move gnu ld check for
        the flag to the top so it can be overridden.
        (AC_LIBTOOL_LANG_CXX_CONFIG): Unset whole_archive_flag_spec for
        the portland group's c++ compiler too.

diff --git a/libltdl/Makefile.am b/libltdl/Makefile.am
index 3c4e604adb79e90451ed9b5fdfd2a8e04a976dc5..73397da06151bccc796f9eca2e149595640882f5 100644 (file)
--- a/libltdl/Makefile.am
+++ b/libltdl/Makefile.am
@@ -37,5 +37,5 @@ ltdldatadir = $(datadir)/libtool/libltdl
 install-data-local:
        -rm -rf $(DESTDIR)$(ltdldatadir)
        $(mkinstalldirs) $(DESTDIR)$(ltdldatadir)
-       $(AMTAR) cf - $(DISTFILES) \
+       $(AMTAR) chof - $(DISTFILES) \
          | ( cd $(DESTDIR)$(ltdldatadir) && $(AMTAR) xf -; )

diff --git a/libtoolize.in b/libtoolize.in
index 5efcc8f60b616c2acbf73fe3b32d0251942467e7..bba03a91c3e79dda6266452e5e6ef7f1e8658b97 100644 (file)
--- a/libtoolize.in
+++ b/libtoolize.in
@@ -293,7 +293,7 @@ for file in $ltdlfiles; do
 
   $rm $file
   if test -n "$ln_s" && $ln_s $pkgdatadir/$file $file; then :
-  elif { ( cd $pkgdatadir && $tar cf - $file 2> /dev/null; ) \
+  elif { ( cd $pkgdatadir && $tar chof - $file 2> /dev/null; ) \
       | $tar xf - > /dev/null 2>&1; } ; then :
   elif $cp $pkgdatadir/$file $file; then :
   else