new version: 2016.4.4

This avoids a malicious repository writing to files outside the local
storage root.
(cherry picked from commit a2b111bb09)

simgear/io/HTTPRepository.cxx

@@ -612,6 +612,14 @@ private:
                 SG_LOG(SG_TERRASYNC, SG_WARN, "malformed .dirindex file: invalid type in line '" << line << "', expected 'd' or 'f', (ignoring line)" );
                 continue;
             }
+
+            // security: prevent writing outside the repository via ../../.. filenames
+            // (valid filenames never contain / - subdirectories have their own .dirindex)
+            if ((tokens[1] == "..") || (tokens[1].find_first_of("/\\") != std::string::npos)) {
+                SG_LOG(SG_TERRASYNC, SG_WARN, "malformed .dirindex file: invalid filename in line '" << line << "', (ignoring line)" );
+                continue;
+            }
+
             children.push_back(ChildInfo(typeData == "f" ? ChildInfo::FileType : ChildInfo::DirectoryType, tokens[1], tokens[2]));
 
             if (tokens.size() > 3) {

simgear/package/CatalogTest.cxx

@@ -175,9 +175,14 @@ int parseTest()
       // expected
     }
 
+    unsigned int skisVariantFull = p2->indexOfVariant("org.flightgear.test.catalog1.c172p-skis");
+    VERIFY(skisVariantFull > 0);
+
     unsigned int skisVariant = p2->indexOfVariant("c172p-skis");
     VERIFY(skisVariant > 0);
 
+    COMPARE(skisVariant, skisVariantFull);
+
     pkg::Package::ThumbnailVec thumbs2 = p2->thumbnailsForVariant(skisVariant);
     COMPARE(thumbs2.size(), 2);
 

simgear/package/Package.cxx

@@ -340,13 +340,25 @@ std::string Package::nameForVariant(const std::string& vid) const
 
 unsigned int Package::indexOfVariant(const std::string& vid) const
 {
-    if (vid == id()) {
+    // accept fully-qualified IDs here
+    std::string actualId = vid;
+    size_t lastDot = vid.rfind('.');
+    if (lastDot != std::string::npos) {
+        std::string catalogId = vid.substr(0, lastDot);
+        if (catalogId != catalog()->id()) {
+            throw sg_exception("Bad fully-qualified ID:" + vid + ", package mismatch" );
+        }
+        actualId = vid.substr(lastDot + 1);
+    }
+
+
+    if (actualId == id()) {
         return 0;
     }
 
     unsigned int result = 1;
     for (SGPropertyNode* var : m_props->getChildren("variant")) {
-        if (var->getStringValue("id") == vid) {
+        if (var->getStringValue("id") == actualId) {
             return result;
         }
 

version

@@ -1 +1 @@
-2016.4.1
+2016.4.4