File CVE-2018-10916.patch of Package lftp.9841

From a27e07d90a4608ceaf928b1babb27d4d803e1992 Mon Sep 17 00:00:00 2001
From: "Alexander V. Lukyanov" <lavv17f@gmail.com>
Date: Tue, 31 Jul 2018 10:57:35 +0300
Subject: [PATCH] mirror: prepend ./ to rm and chmod arguments to avoid URL
 recognition (fix #452)

---
 src/MirrorJob.cc | 24 +++++++++---------------
 1 file changed, 9 insertions(+), 15 deletions(-)

Index: lftp-4.7.4/src/MirrorJob.cc
===================================================================
--- lftp-4.7.4.orig/src/MirrorJob.cc	2016-11-01 07:48:01.000000000 +0000
+++ lftp-4.7.4/src/MirrorJob.cc	2019-03-01 15:34:18.393894729 +0000
@@ -1114,24 +1114,21 @@ int   MirrorJob::Do()
 	    }
 	    continue;
 	 }
+	 bool use_rmdir = (file->TypeIs(file->DIRECTORY)
+			   && recursion_mode==RECURSION_NEVER);
 	 if(script)
 	 {
-	    ArgV args("rm");
-	    if(file->TypeIs(file->DIRECTORY))
-	    {
-	       if(recursion_mode==RECURSION_NEVER)
-		  args.setarg(0,"rmdir");
-	       else
+	    ArgV args(use_rmdir?"rmdir":"rm");
+	    if(file->TypeIs(file->DIRECTORY) && !use_rmdir)
 		  args.Append("-r");
-	    }
 	    args.Append(target_session->GetFileURL(file->name));
 	    xstring_ca cmd(args.CombineQuoted());
 	    fprintf(script,"%s\n",cmd.get());
 	 }
 	 if(!script_only)
 	 {
-	    ArgV *args=new ArgV("rm");
-	    args->Append(file->name);
+	    ArgV *args=new ArgV(use_rmdir?"rmdir":"rm");
+	    args->Append(dir_file(".",file->name));
 	    args->seek(1);
 	    rmJob *j=new rmJob(target_session->Clone(),args);
 	    j->cmdline.set_allocated(args->Combine());
@@ -1139,10 +1136,7 @@ int   MirrorJob::Do()
 	    if(file->TypeIs(file->DIRECTORY))
 	    {
 	       if(recursion_mode==RECURSION_NEVER)
-	       {
-		  args->setarg(0,"rmdir");
 		  j->Rmdir();
-	       }
 	       else
 		  j->Recurse();
 	    }
@@ -1206,7 +1200,7 @@ int   MirrorJob::Do()
 	 if(!script_only)
 	 {
 	    ArgV *a=new ArgV("chmod");
-	    a->Append(file->name);
+	    a->Append(dir_file(".",file->name));
 	    a->seek(1);
 	    ChmodJob *cj=new ChmodJob(target_session->Clone(),
 				 file->mode&~mode_mask,a);
@@ -1325,7 +1319,7 @@ int   MirrorJob::Do()
 	 if(!script_only)
 	 {
 	    ArgV *args=new ArgV("rm");
-	    args->Append(file->name);
+	    args->Append(dir_file(".",file->name));
 	    args->seek(1);
 	    rmJob *j=new rmJob(source_session->Clone(),args);
 	    j->cmdline.set_allocated(args->Combine());