From 111e0f2c1ef30bf25ee5a15c0939396c0bbad946 Mon Sep 17 00:00:00 2001
From: bluhm <bluhm@openbsd.org>
Date: Wed, 25 Oct 2023 20:05:43 +0000
Subject: [PATCH] Fix unveil(2) in patch(1) with explicit patchfile.

A backup file should be created in the directory of the original
file, but only the current directory was unveiled.  Then the patched
file was created in /tmp and did not replace the original patchfile
in place.  If a patchfile is passed in argv[0], unveil its directory
instead of current directory.

OK florian@ deraadt@ millert@
---
 usr.bin/patch/patch.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/usr.bin/patch/patch.c b/usr.bin/patch/patch.c
index 322a024cf2c..1e926d1b6a5 100644
--- a/usr.bin/patch/patch.c
+++ b/usr.bin/patch/patch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: patch.c,v 1.74 2023/07/19 13:26:20 tb Exp $	*/
+/*	$OpenBSD: patch.c,v 1.75 2023/10/25 20:05:43 bluhm Exp $	*/
 
 /*
  * patch - a program to apply diffs to original files
@@ -32,6 +32,7 @@
 
 #include <ctype.h>
 #include <getopt.h>
+#include <libgen.h>
 #include <limits.h>
 #include <paths.h>
 #include <stdio.h>
@@ -213,11 +214,27 @@ main(int argc, char *argv[])
 			perror("unveil");
 			my_exit(2);
 		}
-	if (filearg[0] != NULL)
+	if (filearg[0] != NULL) {
+		char *origdir;
+
 		if (unveil(filearg[0], "rwc") == -1) {
 			perror("unveil");
 			my_exit(2);
 		}
+		if ((origdir = dirname(filearg[0])) == NULL) {
+			perror("dirname");
+			my_exit(2);
+		}
+		if (unveil(origdir, "rwc") == -1) {
+			perror("unveil");
+			my_exit(2);
+		}
+	} else {
+		if (unveil(".", "rwc") == -1) {
+			perror("unveil");
+			my_exit(2);
+		}
+	}
 	if (filearg[1] != NULL)
 		if (unveil(filearg[1], "r") == -1) {
 			perror("unveil");
@@ -228,10 +245,6 @@ main(int argc, char *argv[])
 			perror("unveil");
 			my_exit(2);
 		}
-	if (unveil(".", "rwc") == -1) {
-		perror("unveil");
-		my_exit(2);
-	}
 	if (*rejname != '\0')
 		if (unveil(rejname, "rwc") == -1) {
 			perror("unveil");
-- 
2.20.1