system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-04 15:40:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Be much more paranoid about where uudecode writes its output, especially

Browse source 
when the filename comes from the untrusted input. This is a work-around
for careless people who don't routinely check the begin line of the file
or run uudecode -i and instead report "vulnerabilities" to CERT.
	http://www.kb.cert.org/vuls/id/336083
This commit is contained in:
Tony Finch 2002-11-01 00:58:00 +00:00
parent eae1ff453a
commit 735838d3fe
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=106275
1 changed files with 36 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
usr.bin/uudecode/uudecode.c
View file

@ -59,6 +59,8 @@ __FBSDID("$FreeBSD$");
#include <netinet/in.h> #include <netinet/in.h>
#include <err.h> #include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <pwd.h> #include <pwd.h>
#include <resolv.h> #include <resolv.h>
#include <stdio.h> #include <stdio.h>
@ -231,14 +233,41 @@ decode2(void)
return (1); return (1);
} }
if (!pflag) { if (pflag)
if (iflag && !access(buffn, F_OK)) { outfp = stdout;
warnx("not overwritten: %s", buffn); else {
return (0); int flags = O_WRONLY|O_CREAT|O_EXCL;
if (lstat(buffn, &st) == 0) {
if (iflag) {
warnc(EEXIST, "%s: %s", filename, buffn);
return (0);
}
switch (st.st_mode & S_IFMT) {
case S_IFREG:
case S_IFLNK:
/* avoid symlink attacks */
if (unlink(buffn) == 0 || errno == ENOENT)
break;
warn("%s: unlink %s", filename, buffn);
return (1);
case S_IFDIR:
warnc(EISDIR, "%s: %s", filename, buffn);
return (1);
default:
if (oflag) {
/* trust command-line names */
flags &= ~O_EXCL;
break;
}
warnc(EEXIST, "%s: %s", filename, buffn);
return (1);
}
} else if (errno != ENOENT) {
warn("%s: %s", filename, buffn);
return (1);
} }
if ((outfp = fopen(buffn, "w")) == NULL || if ((i = open(buffn, flags, getmode(mode, 0) & 0666)) < 0 ||
stat(buffn, &st) < 0 || (S_ISREG(st.st_mode) && (outfp = fdopen(i, "w")) == NULL) {
fchmod(fileno(outfp), getmode(mode, 0) & 0666) < 0)) {
warn("%s: %s", filename, buffn); warn("%s: %s", filename, buffn);
return (1); return (1);
} }