--- httpd-2.0.42/server/config.c.wiget Thu Sep 12 22:04:07 2002 +++ httpd-2.0.42/server/config.c Wed Sep 25 12:07:10 2002 @@ -1458,6 +1458,7 @@ apr_dir_t *dirp; apr_finfo_t dirent; int current; + size_t slen; apr_array_header_t *candidates = NULL; fnames *fnew; apr_status_t rv; @@ -1505,9 +1506,15 @@ candidates = apr_array_make(p, 1, sizeof(fnames)); while (apr_dir_read(&dirent, APR_FINFO_DIRENT, dirp) == APR_SUCCESS) { + slen = strlen(dirent.name); /* strip out '.' and '..' */ if (strcmp(dirent.name, ".") && strcmp(dirent.name, "..") + && (dirent.name)[slen-1] != '~' + && (dirent.name)[0] != '.' + && (slen < 8 || strcmp((dirent.name + slen - 7), ".rpmnew")) + && (slen < 9 || ( strcmp((dirent.name + slen - 8), ".rpmorig") + && strcmp((dirent.name + slen - 8), ".rpmsave"))) && (!ispatt || apr_fnmatch(pattern, dirent.name, FNM_PERIOD) == APR_SUCCESS)) {