You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
71 lines
2.4 KiB
71 lines
2.4 KiB
11 years ago
|
From c0989dce2d882c94eb3183e7b94402ba53534abb Mon Sep 17 00:00:00 2001
|
||
|
|
Message-Id: <c0989dce2d882c94eb3183e7b94402ba53534abb.1398703637.git.luto@amacapital.net>
|
||
|
|
In-Reply-To: <3c5d5b344ee945b99e4bb16a44af6f293601813d.1398703637.git.luto@amacapital.net>
|
||
|
|
References: <3c5d5b344ee945b99e4bb16a44af6f293601813d.1398703637.git.luto@amacapital.net>
|
||
|
|
From: David Adam <zanchey@ucc.gu.uwa.edu.au>
|
||
|
|
Date: Sun, 20 Apr 2014 23:51:20 +0800
|
||
|
|
Subject: [PATCH 4/4] use mktemp(1) to generate temporary file names
|
||
|
|
|
||
|
|
Fix for CVE-2014-2906.
|
||
|
|
|
||
|
|
Closes a race condition in funced which would allow execution of
|
||
|
|
arbitrary code; closes a race condition in psub which would allow
|
||
|
|
alternation of the data stream.
|
||
|
|
|
||
|
|
Note that `psub -f` does not work (#1040); a fix should be committed
|
||
|
|
separately for ease of maintenance.
|
||
|
|
---
|
||
|
|
share/functions/funced.fish | 6 +-----
|
||
|
|
share/functions/psub.fish | 11 +++--------
|
||
|
|
2 files changed, 4 insertions(+), 13 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/share/functions/funced.fish b/share/functions/funced.fish
|
||
|
|
index 3c2de06..ca2e277 100644
|
||
|
|
--- a/share/functions/funced.fish
|
||
|
|
+++ b/share/functions/funced.fish
|
||
|
|
@@ -81,11 +81,7 @@ function funced --description 'Edit function definition'
|
||
|
|
return 0
|
||
|
|
end
|
||
|
|
|
||
|
|
- set -q TMPDIR; or set -l TMPDIR /tmp
|
||
|
|
- set -l tmpname (printf "$TMPDIR/fish_funced_%d_%d.fish" %self (random))
|
||
|
|
- while test -f $tmpname
|
||
|
|
- set tmpname (printf "$TMPDIR/fish_funced_%d_%d.fish" %self (random))
|
||
|
|
- end
|
||
|
|
+ set tmpname (mktemp -t fish_funced.XXXXXXXXXX)
|
||
|
|
|
||
|
|
if functions -q -- $funcname
|
||
|
|
functions -- $funcname > $tmpname
|
||
|
|
diff --git a/share/functions/psub.fish b/share/functions/psub.fish
|
||
|
|
index 42e34c7..7877aa4 100644
|
||
|
|
--- a/share/functions/psub.fish
|
||
|
|
+++ b/share/functions/psub.fish
|
||
|
|
@@ -45,21 +45,16 @@ function psub --description "Read from stdin into a file and output the filename
|
||
|
|
return
|
||
|
|
end
|
||
|
|
|
||
|
|
- # Find unique file name for writing output to
|
||
|
|
- while true
|
||
|
|
- set filename /tmp/.psub.(echo %self).(random);
|
||
|
|
- if not test -e $filename
|
||
|
|
- break;
|
||
|
|
- end
|
||
|
|
- end
|
||
|
|
-
|
||
|
|
if test use_fifo = 1
|
||
|
|
# Write output to pipe. This needs to be done in the background so
|
||
|
|
# that the command substitution exits without needing to wait for
|
||
|
|
# all the commands to exit
|
||
|
|
+ set dir (mktemp -d /tmp/.psub.XXXXXXXXXX); or return
|
||
|
|
+ set filename $dir/psub.fifo
|
||
|
|
mkfifo $filename
|
||
|
|
cat >$filename &
|
||
|
|
else
|
||
|
|
+ set filename (mktemp /tmp/.psub.XXXXXXXXXX)
|
||
|
|
cat >$filename
|
||
|
|
end
|
||
|
|
|
||
|
|
--
|
||
|
|
1.9.0
|
||
|
|
|