* libtoolize.m4sh (func_copy_cb): Use tar chof to avoid symlink

attacks.
* libltdl/Makefile.am, libltdl/loaders/Makefile.am
(install-data-local): Ditto.

diff --git a/ChangeLog b/ChangeLog
index 0c29e9d923bf81e8fbb98bee0bf2f6170165915f..ccf5c4bace25649db5ac0806ece45f90e06bfd76 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2005-03-02  Gary V. Vaughan  <gary@gnu.org>
+
+       * libtoolize.m4sh (func_copy_cb): Use tar chof to avoid symlink
+       attacks.
+       * libltdl/Makefile.am, libltdl/loaders/Makefile.am
+       (install-data-local): Ditto.
+
 2005-02-27  Gary V. Vaughan  <gary@gnu.org>
 
        In branch-2-0 (and in time, others) ltversion.m4 has a dot

diff --git a/libltdl/Makefile.am b/libltdl/Makefile.am
index 0a483ec8b2bdec224b4e473d7b11e8d8bede68fd..ef14f558eed9d13cea410414c5db9d9e718fc3a3 100644 (file)
--- a/libltdl/Makefile.am
+++ b/libltdl/Makefile.am
@@ -77,7 +77,7 @@ ltdldatafiles         = COPYING.LIB Makefile.am README configure.ac \
 ## with libtoolize, we have to preserve their timestamps carefully:
 install-data-local:
        $(mkinstalldirs) $(DESTDIR)$(ltdldatadir)
-       ( cd $(srcdir) && $(AMTAR) cf - $(ltdldatafiles); ) \
+       ( cd $(srcdir) && $(AMTAR) chof - $(ltdldatafiles); ) \
          | ( cd $(DESTDIR)$(ltdldatadir) && $(AMTAR) xf -; )
 
 ## Make sure these will be cleaned even when they're not built by default:

diff --git a/libltdl/loaders/Makefile.am b/libltdl/loaders/Makefile.am
index 5b64155848793bf5823dcc6b54b6a1c658503b6a..197df4583019958efdde5df3468559525596a381 100644 (file)
--- a/libltdl/loaders/Makefile.am
+++ b/libltdl/loaders/Makefile.am
@@ -54,5 +54,5 @@ ltdldatafiles         = Makefile.am dld_link.c dlopen.c dyld.c \
 ## with libtoolize, we have to preserve their timestamps carefully:
 install-data-local:
        $(mkinstalldirs) $(DESTDIR)$(ltdldatadir)
-       ( cd $(srcdir) && $(AMTAR) cf - $(ltdldatafiles) preopen.c; ) \
+       ( cd $(srcdir) && $(AMTAR) chof - $(ltdldatafiles); ) \
          | ( cd $(DESTDIR)$(ltdldatadir) && $(AMTAR) xf -; )

diff --git a/libtoolize.m4sh b/libtoolize.m4sh
index a068e9fb3a4631a130c648db3fe0f39e4c3dccb7..f35cfd4a126f23dd9772a426d4f4234f2b159bd2 100644 (file)
--- a/libtoolize.m4sh
+++ b/libtoolize.m4sh
@@ -230,7 +230,7 @@ func_copy_cb ()
     if $opt_link && $LN_S "$my_srcdir/$my_file" "$my_destdir/$my_file"; then
       $opt_quiet || func_echo "copying file \`$my_destdir/$my_file'"
       copy_return_status=0
-    elif { ( cd "$my_srcdir" && $TAR cf - "$my_file" 2> /dev/null; ) \
+    elif { ( cd "$my_srcdir" && $TAR chof - "$my_file" 2> /dev/null; ) \
         | ( cd "$my_destdir" && "$TAR" xf - > /dev/null 2>&1; ) } ; then
       $opt_quiet || func_echo "copying file \`$my_destdir/$my_file'"
       copy_return_status=0