add fix for #862667

diff --git a/debian/changelog b/debian/changelog
index faf131913e7db5b9a6e155f6f6976de093b2cac0..deeb54a53294e0e825526c4d95ebe4fb0aebf75d 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+perltidy (20160302-1) unstable; urgency=medium
+
+  * New upstream release
+  * Die if an existing perltidy.ERR cannot be removed to block overwriting
+    of arbitrary files by a symlink attack. (closes: #862667) Thanks to
+    Jakub Wilk for identifying this issue.
+
+ --
+
 perltidy (20140328-1) unstable; urgency=medium
 
   * New upstream release

diff --git a/debian/patches/die_on_unlink_failures b/debian/patches/die_on_unlink_failures
new file mode 100644 (file)
index 0000000..c950d7e
--- /dev/null
+++ b/debian/patches/die_on_unlink_failures
@@ -0,0 +1,28 @@
+Description: die if perltidy.ERR and other temporary files cannot be unlinked
+Origin: vendor, https://bugs.debian.org/862667
+Author: Don Armstrong <don@debian.org>
+--- a/lib/Perl/Tidy.pm
++++ b/lib/Perl/Tidy.pm
+@@ -3692,7 +3692,9 @@
+     # now wish for luck...
+     my $msg = qx/perl $flags $quoted_stream_filename $error_redirection/;
+ 
+-    unlink $stream_filename if ($is_tmpfile);
++    unlink $stream_filename or
++        Perl::Tidy::Die("couldn't unlink stream ${stream_filename}: $!\n")
++            if ($is_tmpfile);
+     return $stream_filename, $msg;
+ }
+ 
+@@ -4128,7 +4130,10 @@
+ 
+     # remove any old error output file if we might write a new one
+     unless ( $fh_warnings || ref($warning_file) ) {
+-        if ( -e $warning_file ) { unlink($warning_file) }
++        if ( -e $warning_file ) {
++            unlink($warning_file) or
++                Perl::Tidy::Die("couldn't unlink warning file ${warning_file}: $!\n");
++        }
+     }
+ 
+     my $logfile_gap =

diff --git a/debian/patches/series b/debian/patches/series
index 9b1049a47296ab6692d1a8e6e0f0b0528e0436a7..a54562cc7d262382b47ea90838b740cf1a8c3fd6 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
+die_on_unlink_failures
 document_bst_better