[patch] sandbox-1.2.18.patch

sandbox.patch (text/plain), 2.08 KB, created by Martin Schlemmer (RETIRED) on 2006-05-09 02:33:24 UTC

--- sandbox_1_2_18/src/libsandbox.c	2006-05-03 13:33:15.000000000 +0200
+++ trunk/src/libsandbox.c	2006-05-09 11:37:42.000000000 +0200
@@ -901,7 +901,7 @@
 char *egetcwd(char *buf, size_t size)
 {
 	struct stat st;
-	char *tmpbuf;
+	char *tmpbuf, *oldbuf = buf;
 	int old_errno;
 
 	/* Need to disable sandbox, as on non-linux libc's, opendir() is
@@ -913,37 +913,51 @@
 	errno = 0;
 	tmpbuf = true_getcwd_DEFAULT(buf, size);
 	sandbox_on = 1;
-	if (tmpbuf) {
+
+	/* We basically try to figure out if we can trust what getcwd()
+	 * returned.  If one of the following happens kernel/libc side,
+	 * bad things will happen, but not much we can do about it:
+	 *  - Invalid pointer with errno = 0
+	 *  - Truncated path with errno = 0
+	 *  - Whatever I forgot about
+	 */
+	if ((tmpbuf) && (errno == 0)) {
 		old_errno = errno;
 		lstat(buf, &st);
 
 		if (errno == ENOENT) {
+		  	/* If getcwd() allocated the buffer, free it. */
+			if (NULL == oldbuf)
+				free(tmpbuf);
+
 			/* If lstat() failed with eerror = ENOENT, then its
 			 * possible that we are running on an older kernel
 			 * which had issues with returning invalid paths if
-			 * they got too long.
+			 * they got too long.  Return with errno = ENAMETOOLONG,
+			 * so that canonicalize() and check_syscall() know
+			 * what the issue is.
 			 */
 		  	errno = ENAMETOOLONG;
-			free(tmpbuf);
 			return NULL;
 		} else if (errno != 0) {
+		  	/* If getcwd() allocated the buffer, free it. */
+			if (NULL == oldbuf)
+				free(tmpbuf);
+
 			/* Not sure if we should quit here, but I guess if
-			 * lstat() fails, getcwd could have messed up.
+			 * lstat() fails, getcwd could have messed up. Not
+			 * sure what to do about errno - use lstat()'s for
+			 * now.
 			 */
-			free(tmpbuf);
 			return NULL;
 		}
 
 		errno = old_errno;
-	}
-
-	/* Make sure we do not return garbage if the current libc or kernel's
-	 * getcwd() is buggy.
-	 */
-	if (errno != 0) {
-	  	if (tmpbuf)
-			free(tmpbuf);
+	} else if (errno != 0) {
 
+		/* Make sure we do not return garbage if the current libc or
+		 * kernel's getcwd() is buggy.
+		 */
 		return NULL;
 	}