libimobiledevice/libimobiledevice — pull request #9 by federicomenaquintero (2013-07-03 01:47:05+00:00)
Title: Fix CVE from bug #331

Here is a patch set that does two things:

1. Adds a common/utils.c with a string_concat() function. This is to avoid chains of strcat(), which is unsafe and O(n^2).

2. Falls back to getpwuid_r() if neither HOME nor XDG_CONFIG_HOME are set. This removes the possibility of a symlink attack in /tmp when libimobiledevice is being run as root.