Blame SOURCES/0088-a-a-save-package-data-turn-off-reading-data-from-roo.patch

baab13
From fdf93685d4f3fc36fe50d34a11e24662c4cb2d8c Mon Sep 17 00:00:00 2001
baab13
From: Jakub Filak <jfilak@redhat.com>
baab13
Date: Wed, 15 Apr 2015 12:12:59 +0200
baab13
Subject: [ABRT PATCH] a-a-save-package-data: turn off reading data from root
baab13
 directories
baab13
baab13
Making copies of files from arbitrary root directories is not secure.
baab13
baab13
Related: #1211835
baab13
baab13
Signed-off-by: Jakub Filak <jfilak@redhat.com>
baab13
---
baab13
 src/daemon/abrt-action-save-package-data.c | 8 ++------
baab13
 1 file changed, 2 insertions(+), 6 deletions(-)
baab13
baab13
diff --git a/src/daemon/abrt-action-save-package-data.c b/src/daemon/abrt-action-save-package-data.c
baab13
index 6dbcfc2..97d5f5e 100644
baab13
--- a/src/daemon/abrt-action-save-package-data.c
baab13
+++ b/src/daemon/abrt-action-save-package-data.c
baab13
@@ -223,7 +223,6 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
 
baab13
     char *cmdline = NULL;
baab13
     char *executable = NULL;
baab13
-    char *rootdir = NULL;
baab13
     char *package_short_name = NULL;
baab13
     struct pkg_envra *pkg_name = NULL;
baab13
     char *component = NULL;
baab13
@@ -233,8 +232,6 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
 
baab13
     cmdline = dd_load_text_ext(dd, FILENAME_CMDLINE, DD_FAIL_QUIETLY_ENOENT);
baab13
     executable = dd_load_text(dd, FILENAME_EXECUTABLE);
baab13
-    rootdir = dd_load_text_ext(dd, FILENAME_ROOTDIR,
baab13
-                               DD_FAIL_QUIETLY_ENOENT | DD_LOAD_TEXT_RETURN_NULL_ON_FAILURE);
baab13
 
baab13
     /* Close dd while we query package database. It can take some time,
baab13
      * don't want to keep dd locked longer than necessary */
baab13
@@ -246,7 +243,7 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
         goto ret; /* return 1 (failure) */
baab13
     }
baab13
 
baab13
-    pkg_name = rpm_get_package_nvr(executable, rootdir);
baab13
+    pkg_name = rpm_get_package_nvr(executable, NULL);
baab13
     if (!pkg_name)
baab13
     {
baab13
         if (settings_bProcessUnpackaged)
baab13
@@ -329,7 +326,7 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
          */
baab13
     }
baab13
 
baab13
-    component = rpm_get_component(executable, rootdir);
baab13
+    component = rpm_get_component(executable, NULL);
baab13
 
baab13
     dd = dd_opendir(dump_dir_name, /*flags:*/ 0);
baab13
     if (!dd)
baab13
@@ -355,7 +352,6 @@ static int SavePackageDescriptionToDebugDump(const char *dump_dir_name)
baab13
  ret:
baab13
     free(cmdline);
baab13
     free(executable);
baab13
-    free(rootdir);
baab13
     free(package_short_name);
baab13
     free_pkg_envra(pkg_name);
baab13
     free(component);
baab13
-- 
baab13
1.8.3.1
baab13