Fix for CVE-2014-9512 from upstream at https://rsync.samba.org 

--- rsync-3.1.1/flist.c.old	2015-09-04 14:58:04.610748249 -0700

+++ rsync-3.1.1/flist.c	2015-09-04 15:02:22.838695225 -0700

@@ -2435,8 +2435,9 @@

 	return flist;

 }

-struct file_list *recv_file_list(int f)

+struct file_list *recv_file_list(int f, int dir_ndx)

 {

+       const char *good_dirname = NULL;

 	struct file_list *flist;

 	int dstart, flags;

 	int64 start_read;

@@ -2491,6 +2492,23 @@

 		flist_expand(flist, 1);

 		file = recv_file_entry(f, flist, flags);

+               if (inc_recurse) {

+                       static const char empty_dir[] = "\0";

+                       const char *cur_dir = file->dirname ? file->dirname : empty_dir;

+                       if (relative_paths && *cur_dir == '/')

+                               cur_dir++;

+                       if (cur_dir != good_dirname) {

+                               const char *d = dir_ndx >= 0 ? f_name(dir_flist->files[dir_ndx], NULL) : empty_dir;

+                               if (strcmp(cur_dir, d) != 0) {

+                                       rprintf(FERROR,

+                                               "ABORTING due to invalid dir prefix from sender: %s (should be: %s)\n",

+                                               cur_dir, d);

+                                       exit_cleanup(RERR_PROTOCOL);

+                               }

+                               good_dirname = cur_dir;

+                       }

+               }

+

 		if (S_ISREG(file->mode)) {

 			/* Already counted */

@@ -2615,7 +2633,7 @@

 			rprintf(FINFO, "[%s] receiving flist for dir %d\n",

 				who_am_i(), ndx);

 		}

-		flist = recv_file_list(f);

+		flist = recv_file_list(f, ndx);

 		flist->parent_ndx = ndx;

 	}

 }

--- rsync-3.1.1/io.c.old	2015-09-04 14:58:15.706192874 -0700

+++ rsync-3.1.1/io.c	2015-09-04 15:05:23.471180002 -0700

@@ -1685,7 +1685,7 @@

 				rprintf(FINFO, "[%s] receiving flist for dir %d\n",

 					who_am_i(), ndx);

 			}

-			flist = recv_file_list(iobuf.in_fd);

+			flist = recv_file_list(iobuf.in_fd, ndx);

 			flist->parent_ndx = ndx;

 #ifdef SUPPORT_HARD_LINKS

 			if (preserve_hard_links)

--- rsync-3.1.1/main.c.old	2015-09-04 14:58:24.905761717 -0700

+++ rsync-3.1.1/main.c	2015-09-04 15:07:00.835145092 -0700

@@ -1010,7 +1010,7 @@

 		filesfrom_fd = -1;

 	}

-	flist = recv_file_list(f_in);

+	flist = recv_file_list(f_in, -1);

 	if (!flist) {

 		rprintf(FERROR,"server_recv: recv_file_list error\n");

 		exit_cleanup(RERR_FILESELECT);

@@ -1184,7 +1184,7 @@

 	if (write_batch && !am_server)

 		start_write_batch(f_in);

-	flist = recv_file_list(f_in);

+	flist = recv_file_list(f_in, -1);

 	if (inc_recurse && file_total == 1)

 		recv_additional_file_list(f_in);

--- rsync-3.1.1/rsync.c.old	2015-09-04 14:58:51.928552530 -0700

+++ rsync-3.1.1/rsync.c	2015-09-04 15:07:59.696578389 -0700

@@ -364,7 +364,7 @@

 		}

 		/* Send all the data we read for this flist to the generator. */

 		start_flist_forward(ndx);

-		flist = recv_file_list(f_in);

+		flist = recv_file_list(f_in, ndx);

 		flist->parent_ndx = ndx;

 		stop_flist_forward();

 	}

--- rsync-3.1.1/proto.h.old     2015-09-04 17:46:09.133140046 -0700

+++ rsync-3.1.1/proto.h 2015-09-04 17:45:12.510951663 -0700

@@ -89,7 +89,7 @@

 void unmake_file(struct file_struct *file);

 void send_extra_file_list(int f, int at_least);

 struct file_list *send_file_list(int f, int argc, char *argv[]);

-struct file_list *recv_file_list(int f);

+struct file_list *recv_file_list(int f, int dir_ndx);

 void recv_additional_file_list(int f);

 int flist_find(struct file_list *flist, struct file_struct *f);

 int flist_find_ignore_dirness(struct file_list *flist, struct file_struct *f);