From 82bea520c7c037f861cf27859a194bb64559f835 Mon Sep 17 00:00:00 2001
From: Jakub Filak <jfilak@redhat.com>
Date: Sat, 23 May 2015 01:10:16 +0200
Subject: [LIBREPORT PATCH] dd: add missing return statement
The missing return allows abrt-dbus to read any file on system
(absolute paths do not work because of an assert but relative paths
allow an attacker to read everything).
Related: #1217484
Signed-off-by: Jakub Filak <jfilak@redhat.com>
---
src/lib/dump_dir.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/lib/dump_dir.c b/src/lib/dump_dir.c
index 32f498b..796f947 100644
--- a/src/lib/dump_dir.c
+++ b/src/lib/dump_dir.c
@@ -1153,8 +1153,10 @@ char* dd_load_text_ext(const struct dump_dir *dd, const char *name, unsigned fla
if (!str_is_correct_filename(name))
{
error_msg("Cannot load text. '%s' is not a valid file name", name);
- if (!(flags & DD_LOAD_TEXT_RETURN_NULL_ON_FAILURE))
- xfunc_die();
+ if ((flags & DD_LOAD_TEXT_RETURN_NULL_ON_FAILURE))
+ return NULL;
+
+ xfunc_die();
}
/* Compat with old abrt dumps. Remove in abrt-2.1 */
--
1.8.3.1