Attachment #56955 for bug #89946

Line Link Here

(-)file_not_specified_in_diff (-1 / +14 lines)
0	-- gzip.c	0	++ gzip.c
Lines 1319-1324 Link Here
1319	char *base = p;	1319	char *base = p;
1320	for (;;) {	1320	for (;;) {
1321	*p = (char)get_char();	1321	*p = (char)get_char();
		1322
		1323	/* Don't allow embedded names to contain paths. */
		1324	if (*p == PATH_SEP
		1325	#ifdef PATH_SEP2
		1326	\|\| *p == PATH_SEP2
		1327	#endif
		1328	#ifdef PATH_SEP3
		1329	\|\| *p == PATH_SEP3
		1330	#endif
		1331	) {
		1332	p = base;
		1333	continue;
		1334	}
1322	if (*p++ == '\0') break;	1335	if (*p++ == '\0') break;
1323	if (p >= ofname+sizeof(ofname)) {	1336	if (p >= ofname+sizeof(ofname)) {
1324	error("corrupted input -- file name too large");	1337	error("corrupted input -- file name too large");

Return to bug 89946