36562: sanitize $PWD on import, per POSIX

2 files changed, 21 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index bb03894a0..6d99ccd81 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2015-09-19  Barton E. Schaefer  <schaefer@zsh.org>
+
+	* 36562: Src/utils.c: sanitize $PWD on import, per POSIX
+
 2015-09-19  Peter Stephenson  <p.w.stephenson@ntlworld.com>
 
 	* 36559: Src/pattern.c: test earlier for overflow in pattern
diff --git a/Src/utils.c b/Src/utils.c
index 1de3d9578..ab3b0c274 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -692,9 +692,23 @@ ispwd(char *s)
 {
     struct stat sbuf, tbuf;
 
-    if (stat(unmeta(s), &sbuf) == 0 && stat(".", &tbuf) == 0)
-	if (sbuf.st_dev == tbuf.st_dev && sbuf.st_ino == tbuf.st_ino)
-	    return 1;
+    /* POSIX: environment PWD must be absolute */
+    if (*s != '/')
+	return 0;
+
+    if (stat((s = unmeta(s)), &sbuf) == 0 && stat(".", &tbuf) == 0)
+	if (sbuf.st_dev == tbuf.st_dev && sbuf.st_ino == tbuf.st_ino) {
+	    /* POSIX: No element of $PWD may be "." or ".." */
+	    while (*s) {
+		if (s[0] == '.' &&
+		    (!s[1] || s[1] == '/' ||
+		     (s[1] == '.' && (!s[2] || s[2] == '/'))))
+		    break;
+		while (*s++ != '/' && *s)
+		    continue;
+	    }
+	    return !*s;
+	}
     return 0;
 }