doczkal / rpms / abrt

Forked from rpms/abrt 4 years ago
Clone

Blame SOURCES/0098-ccpp-check-for-overflow-in-abrt-coredump-path-creati.patch

8ec399
From 28ce40d8db91c1926a95f21ef19a980a8af88471 Mon Sep 17 00:00:00 2001
8ec399
From: Jakub Filak <jfilak@redhat.com>
8ec399
Date: Fri, 17 Apr 2015 14:43:59 +0200
8ec399
Subject: [ABRT PATCH] ccpp: check for overflow in abrt coredump path creation
8ec399
8ec399
This issue was discovered by Florian Weimer of Red Hat Product Security.
8ec399
8ec399
Signed-off-by: Jakub Filak <jfilak@redhat.com>
8ec399
---
8ec399
 src/hooks/abrt-hook-ccpp.c | 4 +++-
8ec399
 1 file changed, 3 insertions(+), 1 deletion(-)
8ec399
8ec399
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
8ec399
index d9f1f5e..81f9349 100644
8ec399
--- a/src/hooks/abrt-hook-ccpp.c
8ec399
+++ b/src/hooks/abrt-hook-ccpp.c
8ec399
@@ -669,7 +669,9 @@ int main(int argc, char** argv)
8ec399
          * and maybe crash again...
8ec399
          * Unlike dirs, mere files are ignored by abrtd.
8ec399
          */
8ec399
-        snprintf(path, sizeof(path), "%s/%s-coredump", g_settings_dump_location, last_slash);
8ec399
+        if (snprintf(path, sizeof(path), "%s/%s-coredump", g_settings_dump_location, last_slash) >= sizeof(path))
8ec399
+            error_msg_and_die("Error saving '%s': truncated long file path", path);
8ec399
+
8ec399
         int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
8ec399
         off_t core_size = copyfd_eof(STDIN_FILENO, abrt_core_fd, COPYFD_SPARSE);
8ec399
         if (core_size < 0 || fsync(abrt_core_fd) != 0)
8ec399
-- 
8ec399
1.8.3.1
8ec399