doczkal / rpms / abrt

Forked from rpms/abrt 4 years ago
Clone

Blame SOURCES/0181-ccpp-save-abrt-core-files-only-to-new-files.patch

baab13
From f982995841607f06faaa055740310e0520c07c67 Mon Sep 17 00:00:00 2001
baab13
From: Jakub Filak <jfilak@redhat.com>
baab13
Date: Wed, 30 Sep 2015 12:24:32 +0200
baab13
Subject: [PATCH] ccpp: save abrt core files only to new files
baab13
baab13
Prior this commit abrt-hook-ccpp saved a core file generated by a
baab13
process running a program whose name starts with "abrt" in
baab13
DUMP_LOCATION/$(basename program)-coredump. If the file was a symlink,
baab13
the hook followed and wrote core file to the symlink's target.
baab13
baab13
This commit addresses CVE-2015-5287
baab13
Related: #1262252
baab13
baab13
Signed-off-by: Jakub Filak <jfilak@redhat.com>
baab13
---
baab13
 src/hooks/abrt-hook-ccpp.c | 3 ++-
baab13
 1 file changed, 2 insertions(+), 1 deletion(-)
baab13
baab13
diff --git a/src/hooks/abrt-hook-ccpp.c b/src/hooks/abrt-hook-ccpp.c
baab13
index 7a19cc2..9648b16 100644
baab13
--- a/src/hooks/abrt-hook-ccpp.c
baab13
+++ b/src/hooks/abrt-hook-ccpp.c
baab13
@@ -857,7 +857,8 @@ int main(int argc, char** argv)
baab13
         if (snprintf(path, sizeof(path), "%s/%s-coredump", g_settings_dump_location, last_slash) >= sizeof(path))
baab13
             error_msg_and_die("Error saving '%s': truncated long file path", path);
baab13
 
baab13
-        int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
baab13
+        unlink(path);
baab13
+        int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_EXCL, 0600);
baab13
         off_t core_size = copyfd_eof(STDIN_FILENO, abrt_core_fd, COPYFD_SPARSE);
baab13
         if (core_size < 0 || fsync(abrt_core_fd) != 0)
baab13
         {
baab13
-- 
baab13
1.8.3.1
baab13