[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-trivial] [Qemu-devel] [PATCH] slirp: use less predictable dire

From: Markus Armbruster
Subject: Re: [Qemu-trivial] [Qemu-devel] [PATCH] slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
Date: Mon, 01 Jun 2015 13:23:50 +0200
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux)

Michael Tokarev <address@hidden> writes:

> 01.06.2015 11:01, Markus Armbruster wrote:
> []
>>> -    snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
>>> -             (long)getpid(), instance++);
>>> -    if (mkdir(s->smb_dir, 0700) < 0) {
>>> +    strcpy(s->smb_dir, "/tmp/qemu-smb.XXXXXX");
>>> +    if (!mkdtemp(s->smb_dir)) {
>>>          error_report("could not create samba server dir '%s'", s->smb_dir);
>>>          return -1;
>>>      }
>> Uh, I have to suspend my R-by.  This clobbers s->smb_dir[] when
>> mkdtemp() fails.  Is that safe?  Explain why, and get my R-by back.
> At least this is not different from the original behavour.

Fair enough, R-by unsuspended.

> The only place where this variable is used is in the slirp_smb_cleanup()
> function, which, if smb_dir[0] != 0, does rm -rf on it.
> I think it will be better to add s->smb_dir[0] = 0 here before return.

Makes sense.

> On the other hand this isn't really that important given when we can
> expect mkdtemp() to fail.

Not sure I got this part.  Not sure I need to :)

reply via email to

[Prev in Thread] Current Thread [Next in Thread]