Merge r300361 by mm@:

Backport security fix for absolute path traversal
vulnerability in bsdcpio.

Security: CVE-2015-2304
Security: SA-16:22
Approved by: so