Go to:
Gentoo Home
Documentation
Forums
Lists
Bugs
Planet
Store
Wiki
Get Gentoo!
Gentoo's Bugzilla – Attachment 139225 Details for
Bug 197578
media-video/vobcopy < 1.1.0 Insecure temporary file creation (CVE-2007-5718)
Home
|
New
–
[Ex]
|
Browse
|
Search
|
Privacy Policy
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Relevant parts of vobcopy_1.0.2-1.diff
vobcopy_1.0.2-1.diff (text/plain), 7.90 KB, created by
Robert Buchholz (RETIRED)
on 2007-12-24 00:25:46 UTC
(
hide
)
Description:
Relevant parts of vobcopy_1.0.2-1.diff
Filename:
MIME Type:
Creator:
Robert Buchholz (RETIRED)
Created:
2007-12-24 00:25:46 UTC
Size:
7.90 KB
patch
obsolete
>--- vobcopy-1.0.2.orig/vobcopy.1.de >+++ vobcopy-1.0.2/vobcopy.1.de >@@ -2,7 +2,7 @@ > .\" groff -man -Tascii vobcopy.1 > .\" verarbeiten > .\" >-.TH VOBCOPY 1 "Nov 2005" Linux "User Manuals" >+.TH VOBCOPY 1 "Dez 2007" Linux "User Manuals" > .SH NAME > vobcopy \- kopiert (rippt) Dateien von einer (Video-) DVD auf die Festplatte > .SH SYNTAX >@@ -22,7 +22,9 @@ > .I einzelne zu kopierende Datei > .B ] [-t > .I Name >-.B ] [-v [-v]] [-I] [-V] [-1 >+.B ] [-v [-v]] [-I] [-V] [-L >+.I Logdatei-Pfad >+.B ] [-1 > .I zus�tzliches Ausgabeverzeichnis 1 > .B ] [-2 > .I zus�tzliches Ausgabeverzeichnis 2 >@@ -87,7 +89,7 @@ > in diesem Fall tippe "reset" und Enter, um das Terminal zu retten. > .IP "-q, --quiet" > alle Informations- und Fehlerausschriften von vobcopy werden in die Datei >-/tmp/vobcopy.bla anstatt in die Standardfehlerausgabe geschrieben >+/tmp/vobcopy_XXXXXX anstatt in die Standardfehlerausgabe geschrieben > .IP "-O, --onefile single_file(s)_to_rip" > gibt (eine) einzelne Datei(en) f�r das Kopieren an. Teile von Namen k�nnen > angegeben werden und alle Dateien, die die Namensteile enthalten, werden >@@ -104,6 +106,8 @@ > .IP "-v -v" > schreibt die Ausschriften in eine Logdatei unter /tmp/, um einen Fehlerreport > zu erzeugen. >+.IP "-L LOGDATEI-PFAD" >+weist vobcopy an die Logdatei statt in den Standardpfad in den LOGDATEI-PFAD zu legen. > .IP "-I, --info" > gibt Informationen �ber die Titel, Kapitel und Teile der DVD aus. > .IP "-V, --version" >--- vobcopy-1.0.2.orig/vobcopy.c >+++ vobcopy-1.0.2/vobcopy.c >@@ -64,8 +64,8 @@ > int streamout, block_count, blocks, file_block_count; > // char name[300], op; > char op; >- char dvd_path[255], logfile_name[20],logfile_path[280]; /* TODO: fill logfile_path with all zeros so that, when " if strncpy() finds the source too long IT >- DOES NOT TERMINATE the sink, so the following strcat() is undefined and potentially fatal." - Thanks Leigh!*/ >+ char dvd_path[255], logfile_name[20]; >+ char logfile_path[280] = {0}; /* need room for -L path + "/vobfile_XXXXXX" */ > char dvd_name[35], vobcopy_call[255], provided_dvd_name[35]; > char *size_suffix; > char pwd[255],provided_output_dir[255],provided_input_dir[255]; >@@ -393,7 +393,6 @@ > break; > > case'v': /*verbosity level, can be called multiple times*/ >- strcpy( logfile_path, "/tmp/" ); > verbose_flag = TRUE; > verbosity_level++; > break; >@@ -422,7 +421,6 @@ > call vobcopy (and since the normal logs get written to > /tmp and that gets cleared at every reboot... )*/ > strncpy( logfile_path, optarg, 255 ); >- strcat( logfile_path, "/" ); > verbose_flag = TRUE; > verbosity_level = 2; > break; >@@ -473,47 +471,38 @@ > } > } > >+ /* If the user didnt specify a logfile_path using -L then we do it here */ >+ if (logfile_path[0] == '\0') strcpy(logfile_path, "/tmp"); >+ > fprintf( stderr, "Vobcopy "VERSION" - GPL Copyright (c) 2001 - 2007 robos@muon.de\n" ); > fprintf( stderr, "[Hint] All lines starting with \"libdvdread:\" are not from vobcopy but from the libdvdread-library\n" ); >- if( quiet_flag ) >+ >+ if( quiet_flag || verbosity_level > 1) > { >- fprintf( stderr, "[Hint] Quiet mode - All messages will now end up in /tmp/vobcopy.bla\n" ); >- if ( freopen( "/tmp/vobcopy.bla" , "a" , stderr ) == NULL ) >- { >- printf( "[Error] Aaah! Re-direct of stderr to /tmp/vobcopy.bla didn't work! If -f is not used I stop here... \n" ); >- printf( "[Hint] Use -f to continue (at your risk of stupid ascii text ending up in your vobs\n" ); >- if ( !force_flag ) >- exit( 1 ); >- } >- } >+ int temp; >+ int i; > >+ /* logfile_path was initialized by -L or to "/tmp" & has room for this strcat operation */ >+ strcat(logfile_path, "/vobcopy_XXXXXX"); >+ if ( temp = mkstemp ( logfile_path ) == -1 ) >+ { >+ printf( "[Error] Re-direct of stderr to %s: %s\n", logfile_path, strerror(errno)); >+ exit( 1 ); >+ } >+ else >+ { >+ close( temp ); >+ } > >- if( verbosity_level > 1 ) /* this here starts writing the logfile */ >- { >- fprintf( stderr, "[Info] Uhu, super-verbose\n" ); >+ fprintf( stderr, "[Hint] All messages will now end up in %s\n", logfile_path ); > >- strcpy( logfile_name, "vobcopy_" ); >- strcat( logfile_name, VERSION ); >- strcat( logfile_name, ".log" ); >- strcat( logfile_path, logfile_name ); >- fprintf( stderr, "[Info] The log-file is written to %s\n", logfile_path ); >- fprintf( stderr, "[Hint] Make sure that vobcopy doesn't have to ask questions (like overwriting of old files), these end up in the log file...\n" ); >- fprintf( stderr, "[Hint] If you don't like that position, use -L /path/to/logfile/ instead of -v -v\n" ); >- if ( freopen( logfile_path, "a" , stderr ) == NULL ) >- { >- printf( "[Error] Aaah! Re-direct of stderr to %s didn't work! \n", logfile_path ); >- /* oh no! redirecting of stderr failed, do best to quit gracefully */ >+ if ( freopen(logfile_path , "a" , stderr ) == NULL ) >+ { >+ printf( "[Error] Aaah! Re-direct of stderr to %s didn't work! If -f is not used I stop here... \n", logfile_path ); >+ printf( "[Hint] Use -f to continue (at your risk of stupid ascii text ending up in your vobs\n" ); >+ if ( !force_flag ) > exit( 1 ); >- } >- >- strcpy( vobcopy_call, argv[0] ); >- for( argc_i = 1; argc_i != argc; argc_i++ ) >- { >- strcat( vobcopy_call, " " ); >- strcat( vobcopy_call, argv[argc_i] ); >- } >- fprintf( stderr, "--------------------------------------------------------------------------------\n" ); >- fprintf( stderr, "[Info] Called: %s\n", vobcopy_call ); >+ } > } > > /*sanity check: -m and -n are mutually exclusive... */ >--- vobcopy-1.0.2.orig/vobcopy.1 >+++ vobcopy-1.0.2/vobcopy.1 >@@ -1,7 +1,7 @@ > .\" Process this file with > .\" groff -man -Tascii vobcopy.1 > .\" >-.TH VOBCOPY 1 "Dez 2005" Linux "User Manuals" >+.TH VOBCOPY 1 "Dec 2007" Linux "User Manuals" > .SH NAME > vobcopy \- copy (rip) files from a dvd to the harddisk > .SH SYNOPSIS >@@ -21,7 +21,9 @@ > .I single_file(s)_to_rip > .B ] [-t > .I name >-.B ] [-v [-v]] [-I] [-V] [-1 >+.B ] [-v [-v]] [-I] [-V] [-L >+.I logfile-path >+.B ] [-1 > .I aux_output_dir1 > .B ] [-2 > .I aux_output_dir2 >@@ -74,9 +76,9 @@ > .IP "-n, --title-number TITLE-NUMBER" > specify which title vobcopy shall copy (default is title with most chapters). On the dvd, vts_01_x.vob specify the first title (mostly this is the main feature). > .IP "-o, --output-dir OUTPUT-DIR" >-specify the output-directory of the data. "stdout" or "-" redirect to stdout. Useful for pipeing it to /dev/null ;-) If you forget to pipe it to some place, your terminal will get garbled, so remember that typing "reset" and then Enter will rescue you. >+specify the output-directory of the data. "stdout" or "-" redirect to stdout. Useful for piping it to /dev/null ;-) If you forget to pipe it to some place, your terminal will get garbled, so remember that typing "reset" and then Enter will rescue you. > .IP "-q, --quiet" >-all info- and error-messages of vobcopy will end up in /tmp/vobcopy.bla instead of stderr >+all info- and error-messages of vobcopy will end up in /tmp/vobcopy_XXXXXX instead of stderr (XXXXXX is replaced with a random string) > .IP "-O, --onefile single_file(s)_to_rip" > specify which single file(s) to rip. Parts of names can be given and all > files which include the part will be copied. Files can be listed with comma >@@ -89,6 +91,8 @@ > .IP "-v -v" > prints the information given on command line into a log-file in /tmp/ for > inclusion into a bugreport. >+.IP "-L LOGFILE-PATH" >+tells vobcopy where to put the logfile instead of the default. > .IP "-I, --info" > prints information about the titles, chapters and angles on the dvd. > .IP "-V, --version"
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 197578
: 139225