Re: mkfifo bug -- null ptr dereference

[Jim Meyering]

Daniel Dunbar <address@hidden> wrote:
> We have found another null ptr dereference in mkfifo. The problem is 
> identical to the
> one we found with mkdir.

The fix is the same, too.

        mknod, mkfifo: don't segfault when diagnosing invalid SELinux context

        Identical to the bug fixed by 72d052896a9092b811961a8f3e6ca5d151a59be5.
        * src/mkfifo.c (main): Use "scontext", not NULL optarg in diagnostic.
        * src/mknod.c (main): Likewise.
        Reported by Cristian Cadar, Daniel Dunbar and Dawson Engler.
        * tests/mkdir/selinux: Test for the above fixes.
        * NEWS: Mention the fixes.

Signed-off-by: Jim Meyering <address@hidden>
---
 NEWS                |    1 +
 src/mkfifo.c        |    4 ++--
 src/mknod.c         |    4 ++--
 tests/mkdir/selinux |   15 +++++++++++++++
 4 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/NEWS b/NEWS
index 808061c..e134906 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,7 @@ GNU coreutils NEWS                                    -*- 
outline -*-
   of libselinux.  E.g., ls -l /proc/sys would dereference a NULL pointer.

   "mkdir -Z x dir" no longer segfaults when diagnosing invalid context "x"
+  mkfifo and mknod would fail similarly.  Now they're fixed.

   mv would mistakenly unlink a destination file before calling rename,
   when the destination had two or more hard links.  It no longer does that.
diff --git a/src/mkfifo.c b/src/mkfifo.c
index 95ae214..6abd1be 100644
--- a/src/mkfifo.c
+++ b/src/mkfifo.c
@@ -1,5 +1,5 @@
 /* mkfifo -- make fifo's (named pipes)
-   Copyright (C) 90, 91, 1995-2007 Free Software Foundation, Inc.
+   Copyright (C) 90, 91, 1995-2008 Free Software Foundation, Inc.

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -116,7 +116,7 @@ main (int argc, char **argv)
   if (scontext && setfscreatecon (scontext) < 0)
     error (EXIT_FAILURE, errno,
           _("failed to set default file creation context to %s"),
-          quote (optarg));
+          quote (scontext));

   newmode = (S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH);
   if (specified_mode)
diff --git a/src/mknod.c b/src/mknod.c
index 3b85ae3..8a1718d 100644
--- a/src/mknod.c
+++ b/src/mknod.c
@@ -1,5 +1,5 @@
 /* mknod -- make special files
-   Copyright (C) 90, 91, 1995-2007 Free Software Foundation, Inc.
+   Copyright (C) 90, 91, 1995-2008 Free Software Foundation, Inc.

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -168,7 +168,7 @@ main (int argc, char **argv)
   if (scontext && setfscreatecon (scontext) < 0)
     error (EXIT_FAILURE, errno,
           _("failed to set default file creation context to %s"),
-          quote (optarg));
+          quote (scontext));

   /* Only check the first character, to allow mnemonic usage like
      `mknod /dev/rst0 character 18 0'. */
diff --git a/tests/mkdir/selinux b/tests/mkdir/selinux
index 9bfd090..15651ad 100755
--- a/tests/mkdir/selinux
+++ b/tests/mkdir/selinux
@@ -19,6 +19,8 @@
 if test "$VERBOSE" = yes; then
   set -x
   mkdir --version
+  mkfifo --version
+  mknod --version
 fi

 . $srcdir/../envvar-check
@@ -32,7 +34,20 @@ mkdir -Z $c dir-arg 2> out && fail=1
 cat <<EOF > exp || fail=1
 mkdir: failed to set default file creation context to \`$c': Invalid argument
 EOF
+compare out exp || fail=1
+
+# Until coreutils-6.10.150, mknod and mkfifo had the same problem:
+
+mknod -Z $c b p 2> out && fail=1
+cat <<EOF > exp || fail=1
+mknod: failed to set default file creation context to \`$c': Invalid argument
+EOF
+compare out exp || fail=1

+mkfifo -Z $c f 2> out && fail=1
+cat <<EOF > exp || fail=1
+mkfifo: failed to set default file creation context to \`$c': Invalid argument
+EOF
 compare out exp || fail=1

 (exit $fail); exit $fail
--
1.5.5.rc1.13.g79388