[bug #61424] [libgroff] directory traversal in .fp request

[Dave]

Follow-up Comment #4, bug #61424 (project groff):

The bug has been fixed, but in case someone else tries the example and is as
puzzled as I was:

[comment #0 original submission:]
> Output:
> 
> 
> $ nroff EXPERIMENTS/hello-dave.roff
> EVIL
> 

I could not for the life of me get this output from groff 1.22.4 given the
described setup (with paths altered to match my local system).  I was finally
able to replicate it by moving ~/bogusfont into ~/devascii/bogusfont, and
altering the pathname in hello-dave.roff to match.  Even though the full path
is in the .fp request, I still needed a dev* directory above bogusfont, and
its name had to match the current output device.  I'm mildly curious why it
worked for Branden without those constraints.

(Another curious constraint is that merely specifying a relative path starting
with ../ was insufficient to trigger the bug; the path had to traverse all the
way up to the root directory and back down for .fp to read the file.)

    _______________________________________________________

Reply to this item at:

  <https://savannah.gnu.org/bugs/?61424>

_______________________________________________
  Message sent via Savannah
  https://savannah.gnu.org/