Attachment 581791 Details for Bug 818386 – Patch extracted from upstream mercurial repository

[patch] Patch extracted from upstream mercurial repository

CVE-2012-2451.patch (text/plain), 2.06 KB, created by Stefan Cornelius on 2012-05-03 07:31:26 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Cornelius

Created: 2012-05-03 07:31:26 UTC

Size: 2.06 KB

patch

obsolete

>diff -r 7409037da07b -r a08fa26f4f59 config-inifiles/Build.PL
>--- a/config-inifiles/Build.PL	Wed May 02 10:37:25 2012 +0300
>+++ b/config-inifiles/Build.PL	Wed May 02 10:58:43 2012 +0300
>@@ -31,6 +31,8 @@
>         'Carp' => 0,
>         'Symbol' => 0,
>         'warnings' => 0,
>+        'File::Basename' => 0,
>+        'File::Temp' => 0,
>         'List::MoreUtils' => 0,
>     },
>     create_makefile_pl => 'small',
>diff -r 7409037da07b -r a08fa26f4f59 config-inifiles/Changes
>--- a/config-inifiles/Changes	Wed May 02 10:37:25 2012 +0300
>+++ b/config-inifiles/Changes	Wed May 02 10:58:43 2012 +0300
>@@ -1,4 +1,9 @@
>-* Now requiring List::MoreUtils (for any() and other functions).
>+* SECURITY BUG FIX: Config::IniFiles used to write to a temporary filename
>+with a predictable name ("${filename}-new") which opens the door for potential
>+exploits.
>+
>+* Now requiring List::MoreUtils (for any() and other functions), File::Temp
>+and File::Basename .
> 
> * Add "use warnings;" to lib/Config/IniFiles.pm .
> 
>diff -r 7409037da07b -r a08fa26f4f59 config-inifiles/lib/Config/IniFiles.pm
>--- a/config-inifiles/lib/Config/IniFiles.pm	Wed May 02 10:37:25 2012 +0300
>+++ b/config-inifiles/lib/Config/IniFiles.pm	Wed May 02 10:58:43 2012 +0300
>@@ -12,6 +12,9 @@
> 
> use List::MoreUtils qw(any none);
> 
>+use File::Basename qw( dirname );
>+use File::Temp qw/ tempfile /;
>+
> @Config::IniFiles::errors = ( );
> 
> #   $Header: /home/shlomi/progs/perl/cpan/Config/IniFiles/config-inifiles-cvsbackup/config-inifiles/IniFiles.pm,v 2.41 2003-12-08 10:50:56 domq Exp $
>@@ -1331,11 +1334,10 @@
>             #carp "Store mode $self->{file_mode} prohibits writing config";
>         }
> 
>-        my $new_file = $file . "-new";
>-        open(my $fh, '>', $new_file) || do {
>-            carp "Unable to write temp config file $new_file: $!";
>-            return undef;
>-        };
>+        my ($fh, $new_file) = tempfile(
>+            "temp.ini-XXXXXXXXXX",
>+            DIR => dirname($file)
>+        );
>         $self->OutputConfigToFileHandle($fh, $parms{-delta});
>         close($fh);
>         if (!rename( $new_file, $file )) {

Actions: View | Diff

Attachments on bug 818386: 581791