bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability

[Eli Zaretskii]

> From: "lux" <lx@shellcodes.org>
> Cc: "59544" <59544@debbugs.gnu.org>
> Date: Fri, 25 Nov 2022 14:41:56 +0800
> 
> > That's a possibility, yes.  Although I doubt that people are still using
> > ctags that comes with Emacs (this code fragment runs only in ctags, not in
> > etags).
> 
> I rewrote this code, not use system(1).

Thanks.  I have a few comments:

> +
> +          otags_f = fopen ("OTAGS", "w");
> +          tag_f = fopen (tagfile, "r");

Please use "rb" and "wb" in these fopen calls, so as not to change the EOL
format of the original file.

> +          rename ("OTAGS", tagfile);
> +          unlink ("OTAGS");

We should not delete the original file if 'rename' fails; instead, we should
emit a warning and leave OTAGS alone, so that user could manually rename it.

Can you add a test of this feature to test/manual/etags/Makefile?