Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 113491 Details for
Bug 159556
sys-block/partimage: insecure temporary file creation
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch to fix hardcoded "FINISH_LAST_COUNTFILE" in /tmp
partimage-0.6.4-mkstemp-fix.patch (text/plain), 3.54 KB, created by
Pierre-Yves Rofes (RETIRED)
on 2007-03-16 19:21:56 UTC
(
hide
)
Description:
Patch to fix hardcoded "FINISH_LAST_COUNTFILE" in /tmp
Filename:
MIME Type:
Creator:
Pierre-Yves Rofes (RETIRED)
Created:
2007-03-16 19:21:56 UTC
Size:
3.54 KB
patch
obsolete
>diff -Nurp old/main.cpp new/main.cpp >--- old/main.cpp 2004-02-04 01:57:36.000000000 +0100 >+++ new/main.cpp 2007-03-16 20:03:40.000000000 +0100 >@@ -2,7 +2,7 @@ > main.cpp - description > ------------------- > begin : lun mai 22 18:04:54 CEST 2000 >- copyright : (C) 2000 by François Dupoux >+ copyright : (C) 2000, 2007 by François Dupoux > email : fdupoux@partimage.org > ***************************************************************************/ > // $Revision: 1.70 $ >@@ -103,6 +103,8 @@ static struct option const long_options[ > }; > #endif > >+static char finish_last_countfile_lock[]="/tmp/partimageXXXXXX.lock"; >+static char finish_last_countfile[]="/tmp/partimageXXXXXX"; > static char optstring[]="z:oV:ecmdhf:s:p:bwg:vynSMa:iU:P:XB:"; > FILE * g_fDebug; // debug file > FILE * g_fLocalDebug; // debug file >@@ -768,7 +770,13 @@ int main(int argc, char *argv[]) > > nRetries = 5; > do { >- nLockFile = open(FINISH_LAST_COUNTFILE_LOCK, O_CREAT|O_EXCL, >+ if (mkstemp(finish_last_countfile_lock) == -1) >+ { >+ delete g_interface; >+ fprintf(stderr, i18n("Error: Cannot create lock for countfile")); >+ return EXIT_SUCCESS; >+ } >+ nLockFile = open(finish_last_countfile_lock, O_CREAT|O_EXCL, > O_RDONLY); > if (nLockFile == -1) > { >@@ -782,7 +790,13 @@ int main(int argc, char *argv[]) > fprintf(stderr, i18n("Error: Cannot count remaining partimages")); > return EXIT_SUCCESS; > } >- nCountFile = fopen(FINISH_LAST_COUNTFILE, "r"); >+ if (mkstemp(finish_last_countfile) == -1) >+ { >+ delete g_interface; >+ fprintf(stderr, i18n("Error: Cannot create countfile")); >+ return EXIT_SUCCESS; >+ } >+ nCountFile = fopen(finish_last_countfile, "r"); > if (nCountFile == NULL) > { > delete g_interface; >@@ -796,8 +810,8 @@ int main(int argc, char *argv[]) > delete g_interface; > fclose(nCountFile); > close(nLockFile); >- unlink(FINISH_LAST_COUNTFILE_LOCK); >- unlink(FINISH_LAST_COUNTFILE); >+ unlink(finish_last_countfile_lock); >+ unlink(finish_last_countfile); > // nRes = system("/sbin/shutdown -r now"); > // nRes = system("/sbin/reboot"); > // if we reach this point, it's because shutdown failed >@@ -808,7 +822,7 @@ int main(int argc, char *argv[]) > { > --nValue; > fclose(nCountFile); >- nCountFile = fopen(FINISH_LAST_COUNTFILE, "w"); >+ nCountFile = fopen(finish_last_countfile, "w"); > if (nCountFile == NULL) > { > delete g_interface; >@@ -819,7 +833,7 @@ int main(int argc, char *argv[]) > fprintf(nCountFile, "%d\n", nValue); > fclose(nCountFile); > close(nLockFile); >- unlink(FINISH_LAST_COUNTFILE_LOCK); >+ unlink(finish_last_countfile_lock); > delete g_interface; > return EXIT_SUCCESS; > } >diff -Nurp old/partimage.h new/partimage.h >--- old/partimage.h 2007-03-16 19:53:03.000000000 +0100 >+++ new/partimage.h 2007-03-16 20:02:30.000000000 +0100 >@@ -152,9 +152,6 @@ extern bool g_bSigKill; > #define FINISH_QUIT 3 > #define FINISH_LAST 4 > >-//#define FINISH_LAST_COUNTFILE "/tmp/partimage.count" >-//#define FINISH_LAST_COUNTFILE_LOCK "/tmp/partimage.count.lock" >- > // ===================== MAGIC STRINGS ============================ > #define MAGIC_BEGIN_LOCALHEADER "MAGIC-BEGIN-LOCALHEADER" > #define MAGIC_BEGIN_DATABLOCKS "MAGIC-BEGIN-DATABLOCKS"
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 159556
:
113491
|
115523
|
176426