[SCM] Debian package checker branch, wheezy, updated. 2.5.10.4-15-ge0dc594

["Niels Thykier" <niels@thykier.net>]

The following commit has been merged in the wheezy branch:
commit 77c952285b878e300482f110cb5f3da7c22ad56b
Author: Niels Thykier <niels@thykier.net>
Date:   Thu Apr 4 23:14:58 2013 +0200

    c/debconf: Before opening files, check they are not symlinks
    
    Signed-off-by: Niels Thykier <niels@thykier.net>

diff --git a/checks/debconf b/checks/debconf
index fcd999a..ff35d78 100644
--- a/checks/debconf
+++ b/checks/debconf
@@ -116,9 +116,13 @@ if ($type eq 'source') {
     return 0;
 }
 
-my $cdir = $info->control;
+my $preinst = $info->control('preinst');
+my $ctrl_config = $info->control('config');
+my $ctrl_templates = $info->control('templates');
 
-if (open(PREINST, '<', "$cdir/preinst")) {
+if ( -f $preinst and not -l $preinst) {
+    open(PREINST, '<', $preinst)
+        or fail "open preinst: $!";
     while (<PREINST>) {
         s/\#.*//;    # Not perfect for Perl, but should be OK
         if (m,/usr/share/debconf/confmodule, or
@@ -130,8 +134,8 @@ if (open(PREINST, '<', "$cdir/preinst")) {
     close PREINST;
 }
 
-$seenconfig=1 if -f "$cdir/config";
-$seentemplates=1 if -f "$cdir/templates";
+$seenconfig=1 if -f $ctrl_config and not -l $ctrl_config;
+$seentemplates=1 if -f $ctrl_templates and not -l $ctrl_templates;
 
 # This still misses packages that use debconf only in the postrm.  Packages
 # that ask debconf questions in the postrm should load the confmodule in the
@@ -168,7 +172,9 @@ if ($seenconfig and not $seentemplates and not $usesdbconfig) {
     tag 'no-debconf-config';
 }
 
-if ($seenconfig and not -x "$cdir/config") {
+# $seenconfig will be false if $ctrl_config is a symlink or if it was
+# not a file, so we do not have to check with -f/-l here again.
+if ($seenconfig and not -x $ctrl_config) {
     tag 'debconf-config-not-executable';
 }
 
@@ -180,7 +186,10 @@ my @templates_seen;
 
 if ($seentemplates) {
     eval {
-        @templates = read_dpkg_control("$cdir/templates", DCTRL_DEBCONF_TEMPLATE);
+        # $seentemplates (above) will be false if $ctrl_templates is a
+        # symlink or not a file, so this should be safe without
+        # (re-checking) with -f/-l.
+        @templates = read_dpkg_control($ctrl_templates, DCTRL_DEBCONF_TEMPLATE);
     };
     if ($@) {
         chomp $@;
@@ -353,13 +362,16 @@ my %templates_used;
 my %template_aliases;
 for my $file (qw(config prerm postrm preinst postinst)) {
     my $potential_makedev = {};
-    if (open(IN, '<', "$cdir/$file")) {
+    my $path = $info->control($file);
+    if ( -f $path and not -l $path) {
         my $usesconfmodule='';
         my $obsoleteconfmodule='';
         my $db_input='';
         my $isdefault='';
         my $usesseen='';
 
+        open(IN, '<', $path)
+            or fail "open $file: $!";
         # Only check scripts.
         my $fl = <IN>;
         unless ($fl && $fl =~ /^\#!/) {
diff --git a/debian/changelog b/debian/changelog
index 4933ddc..e23cda2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,8 @@
 lintian (2.5.10.5) unstable; urgency=low
 
   * checks/debconf:
-    + [NT] Fix path traversal issue that could leak information
-      about the host system.
+    + [NT] Fix several path traversal issues that could leak
+      information about the host system.
   * checks/md5sums:
     + [NT] Fix path traversal issue that could leak information
       about the host system.

-- 
Debian package checker