openkylin
/
patch
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Don't leak temporary file on failed ed-style patch 

Now that we write ed-style patches to a temporary file before we
apply them, we need to ensure that the temporary file is removed
before we leave, even on fatal error.

* src/pch.c (do_ed_script): Use global TMPEDNAME instead of local
  tmpname. Don't unlink the file directly, instead tag it for removal
  at exit time.
* src/patch.c (cleanup): Unlink TMPEDNAME at exit.

This closes bug #53820:
https://savannah.gnu.org/bugs/index.php?53820

Fixes: 123eaff0d5d1 ("Fix arbitrary command execution in ed-style patches (CVE-2018-1000156)")

Gbp-Pq: Name 0006-Do_not_leak_temporary_file.patch
This commit is contained in:
Jean Delvare 2018-05-03 14:31:55 +02:00 committed by openKylinBot
parent 6e5f3d2032
commit 5ee73250df
3 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/common.h
View File

@ -94,10 +94,12 @@ XTERN char const *origsuff;
XTERN char const * TMPINNAME;
XTERN char const * TMPOUTNAME;
XTERN char const * TMPPATNAME;
XTERN char const * TMPEDNAME;
XTERN bool TMPINNAME_needs_removal;
XTERN bool TMPOUTNAME_needs_removal;
XTERN bool TMPPATNAME_needs_removal;
XTERN bool TMPEDNAME_needs_removal;
#ifdef DEBUGGING
XTERN int debug;

1
src/patch.c
View File

@ -2003,6 +2003,7 @@ cleanup (void)
remove_if_needed (TMPINNAME, &TMPINNAME_needs_removal);
remove_if_needed (TMPOUTNAME, &TMPOUTNAME_needs_removal);
remove_if_needed (TMPPATNAME, &TMPPATNAME_needs_removal);
remove_if_needed (TMPEDNAME, &TMPEDNAME_needs_removal);
remove_if_needed (TMPREJNAME, &TMPREJNAME_needs_removal);
output_files (NULL);
}

11
src/pch.c
View File

@ -2392,7 +2392,6 @@ do_ed_script (char const *inname, char const *outname,
file_offset beginning_of_this_line;
size_t chars_read;
FILE *tmpfp = 0;
char const *tmpname;
int tmpfd;
pid_t pid;
@ -2404,12 +2403,13 @@ do_ed_script (char const *inname, char const *outname,
invalid commands and treats the next line as a new command, which
can lead to arbitrary command execution. */
tmpfd = make_tempfile (&tmpname, 'e', NULL, O_RDWR | O_BINARY, 0);
tmpfd = make_tempfile (&TMPEDNAME, 'e', NULL, O_RDWR | O_BINARY, 0);
if (tmpfd == -1)
pfatal ("Can't create temporary file %s", quotearg (tmpname));
pfatal ("Can't create temporary file %s", quotearg (TMPEDNAME));
TMPEDNAME_needs_removal = true;
tmpfp = fdopen (tmpfd, "w+b");
if (! tmpfp)
pfatal ("Can't open stream for file %s", quotearg (tmpname));
pfatal ("Can't open stream for file %s", quotearg (TMPEDNAME));
}
for (;;) {
@ -2449,7 +2449,7 @@ do_ed_script (char const *inname, char const *outname,
write_fatal ();
if (lseek (tmpfd, 0, SEEK_SET) == -1)
pfatal ("Can't rewind to the beginning of file %s", quotearg (tmpname));
pfatal ("Can't rewind to the beginning of file %s", quotearg (TMPEDNAME));
if (! dry_run && ! skip_rest_of_patch) {
int exclusive = *outname_needs_removal ? 0 : O_EXCL;
@ -2482,7 +2482,6 @@ do_ed_script (char const *inname, char const *outname,
}
fclose (tmpfp);
safe_unlink (tmpname);
if (ofp)
{