pkg/56733: mtree bug processing filenames containing asterisks

[jgoerzen%complete.org@localhost]

>Number:         56733
>Category:       pkg
>Synopsis:       mtree bug processing filenames containing asterisks
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 28 13:35:00 +0000 2022
>Originator:     John Goerzen
>Release:        Looks to date back 12 years or so
>Organization:
>Environment:
>Description:
Let's say I have a directory containing these files, one of which contains an asterisk:

file*
file2.txt
file.txt
file3.txt

Further assume they are different sizes and have different content.

If, in the output from mtree -c, file* is emitted before the others, the later mtree verify will apparently match all four files using the rule file* and emit errors on the other three.  I observed this in the wild.

A workaround is to manually edit the emitted mtree data and move file* to be after the other non-wildcard files; then it will properly verify.

Additionally, the support for wildcards in the mtree format is not documented that I can see, and probably should be.  Or perhaps it should be removed, since AFAICT, no tools are generating mtree files intentionally using this feature.
>How-To-Repeat:
See above
>Fix:
This may be related to the call to fnmatch in http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/pkgtools/mtree/files/verify.c?rev=1.6&content-type=text/x-cvsweb-markup .

Probably, either:

1) wildcard support in the mtree format should be removed,

or 2) the generation code needs to escape fnmatch glob characters in its output, and this should all be documented.