From 5f9e5afb863298d554d8796dbccb3c0cf46869cb Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Mar 31 2020 09:33:12 +0000
Subject: import lftp-4.4.8-12.el7


---

diff --git a/SOURCES/lftp-4.4.8-gnutls-termination.patch b/SOURCES/lftp-4.4.8-gnutls-termination.patch
deleted file mode 100644
index 686b633..0000000
--- a/SOURCES/lftp-4.4.8-gnutls-termination.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/lftp_ssl.cc.old b/src/lftp_ssl.cc
-index f9bd594..b412ae5 100644
---- a/src/lftp_ssl.cc.old
-+++ b/src/lftp_ssl.cc
-@@ -569,7 +569,7 @@ int lftp_ssl_gnutls::read(char *buf,int size)
-    {
-       if(res==GNUTLS_E_AGAIN || res==GNUTLS_E_INTERRUPTED)
- 	 return RETRY;
--      else if(res==GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
-+      else if(res==GNUTLS_E_UNEXPECTED_PACKET_LENGTH || res==GNUTLS_E_PREMATURE_TERMINATION)
-       {
- 	 Log::global->Format(7,"gnutls_record_recv: %s; assuming EOF\n",gnutls_strerror(res));
- 	 return 0;
diff --git a/SOURCES/lftp-4.4.8-reverse-mirror.patch b/SOURCES/lftp-4.4.8-reverse-mirror.patch
new file mode 100644
index 0000000..1168be8
--- /dev/null
+++ b/SOURCES/lftp-4.4.8-reverse-mirror.patch
@@ -0,0 +1,55 @@
+diff --git a/src/MirrorJob.cc b/src/MirrorJob.cc
+index 595c37b..7eaea27 100644
+--- a/src/MirrorJob.cc
++++ b/src/MirrorJob.cc
+@@ -914,24 +914,21 @@ int   MirrorJob::Do()
+ 	    }
+ 	    continue;
+ 	 }
++	 bool use_rmdir = (file->defined&file->TYPE && file->filetype==file->DIRECTORY)
++						&& (flags&NO_RECURSION);
+ 	 if(script)
+ 	 {
+-	    ArgV args("rm");
+-	    if(file->defined&file->TYPE && file->filetype==file->DIRECTORY)
+-	    {
+-	       if(flags&NO_RECURSION)
+-		  args.setarg(0,"rmdir");
+-	       else
++	    ArgV args(use_rmdir?"rmdir":"rm");
++	    if((file->defined&file->TYPE && file->filetype==file->DIRECTORY) && !use_rmdir)
+ 		  args.Append("-r");
+-	    }
+ 	    args.Append(target_session->GetFileURL(file->name));
+ 	    xstring_ca cmd(args.CombineQuoted());
+ 	    fprintf(script,"%s\n",cmd.get());
+ 	 }
+ 	 if(!script_only)
+ 	 {
+-	    ArgV *args=new ArgV("rm");
+-	    args->Append(file->name);
++	    ArgV *args=new ArgV(use_rmdir?"rmdir":"rm");
++	    args->Append(dir_file(".",file->name));
+ 	    args->seek(1);
+ 	    rmJob *j=new rmJob(target_session->Clone(),args);
+ 	    j->cmdline.set_allocated(args->Combine());
+@@ -940,10 +937,7 @@ int   MirrorJob::Do()
+ 	    if(file->defined&file->TYPE && file->filetype==file->DIRECTORY)
+ 	    {
+ 	       if(flags&NO_RECURSION)
+-	       {
+-		  args->setarg(0,"rmdir");
+ 		  j->Rmdir();
+-	       }
+ 	       else
+ 		  j->Recurse();
+ 	    }
+@@ -1014,7 +1008,7 @@ int   MirrorJob::Do()
+ 	 if(!script_only)
+ 	 {
+ 	    ArgV *a=new ArgV("chmod");
+-	    a->Append(file->name);
++	    a->Append(dir_file(".",file->name));
+ 	    a->seek(1);
+ 	    ChmodJob *cj=new ChmodJob(target_session->Clone(),
+ 				 file->mode&~mode_mask,a);
diff --git a/SPECS/lftp.spec b/SPECS/lftp.spec
index 825f795..92965b5 100644
--- a/SPECS/lftp.spec
+++ b/SPECS/lftp.spec
@@ -1,7 +1,7 @@
 Summary:	A sophisticated file transfer program
 Name:		lftp
 Version:	4.4.8
-Release:	11%{?dist}.1
+Release:	12%{?dist}
 License:	GPLv3+
 Group:		Applications/Internet
 Source0:	ftp://ftp.yar.ru/lftp/lftp-%{version}.tar.xz
@@ -20,7 +20,7 @@ Patch8:  lftp-4.4.8-mirror302-2.patch
 Patch9:  lftp-4.4.8-hangs-mirror.patch
 Patch10: lftp-4.4.8-mirror-file-size-decrease.patch
 Patch11: lftp-4.4.8-max-retries.patch
-Patch12: lftp-4.4.8-gnutls-termination.patch
+Patch12: lftp-4.4.8-reverse-mirror.patch
 
 %description
 LFTP is a sophisticated ftp/http file transfer program. Like bash, it has job
@@ -51,7 +51,7 @@ Utility scripts for use with lftp.
 %patch9 -p1 -b .mirror-hangs
 %patch10 -p1 -b .mirror-file-size-decrease
 %patch11 -p1 -b .max-retries
-%patch12 -p1 -b .gnutls-termination
+%patch12 -p1 -b .reverse-mirror
 
 #sed -i.rpath -e '/lftp_cv_openssl/s|-R.*lib||' configure
 sed -i.norpath -e \
@@ -114,8 +114,8 @@ rm -rf $RPM_BUILD_ROOT
 
 
 %changelog
-* Tue Feb 04 2020 Michal Ruprich <mruprich@redhat.com> - 4.4.8-11.1
-- Resolves: #1797963 - lftp with ssl gives error Fatal error: gnutls_record_recv: The TLS connection was non-properly terminated
+* Wed Jul 24 2019 Michal Ruprich <mruprich@redhat.com> - 4.4.8-12
+- Resolves: #1611641 - CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased
 
 * Fri May 11 2018 Michal Ruprich <mruprich@redhat.com> - 4.4.8-11
 - Resolves: #1514815 - lftp doesn't seems to consider 'set net:max-retries'