Attachment 604260 Details for Bug 848022 – Proposed patch by Jim Meyering to fix CVE-2012-3500

[patch] Proposed patch by Jim Meyering to fix CVE-2012-3500

annotate-output.diff (text/plain), 1.66 KB, created by Jan Lieskovsky on 2012-08-14 10:52:19 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jan Lieskovsky

Created: 2012-08-14 10:52:19 UTC

Size: 1.66 KB

patch

obsolete

>From 33498408778addf1d83033f8ac3efbd250ad905f Mon Sep 17 00:00:00 2001
>From: Jim Meyering <meyering@redhat.com>
>Date: Mon, 13 Aug 2012 15:44:49 +0200
>Subject: [PATCH] annotate-output: prevent symlink attack
>
>* annotate-output: Fix to prevent symlink attack: don't delete
>safely-created file and reuse its name.  Instead, create temporary
>directory and create FIFOs therein.  Also, be sure to remove
>temporaries upon catchable signal.
>---
> bin/ChangeLog       |  8 ++++++++
> bin/annotate-output | 10 +++++++---
> 2 files changed, 15 insertions(+), 3 deletions(-)
>
>diff --git a/bin/ChangeLog b/bin/ChangeLog
>index 1fce0d8..e35efa1 100644
>--- a/bin/ChangeLog
>+++ b/bin/ChangeLog
>@@ -1,3 +1,11 @@
>+2012-08-13  Jim Meyering  <meyering@redhat.com>
>+
>+	annotate-output: prevent symlink attack
>+	* annotate-output: Fix to prevent symlink attack: don't delete
>+	safely-created file and reuse its name.  Instead, create temporary
>+	directory and create FIFOs therein.  Also, be sure to remove
>+	temporaries upon catchable signal.
>+
> 2012-02-28  Jim Meyering  <meyering@redhat.com>
>
> 	* git-verify-branch: Use git rev-list and an explicit SHA1 before
>diff --git a/bin/annotate-output b/bin/annotate-output
>index 6b99ac7..e8d9e58 100755
>--- a/bin/annotate-output
>+++ b/bin/annotate-output
>@@ -62,10 +62,14 @@ if [ $# -lt 1 ]; then
> 	exit 1
> fi
>
>-OUT=`mktemp --tmpdir annotate.XXXXXX` || exit 1
>-ERR=`mktemp --tmpdir annotate.XXXXXX` || exit 1
>+cleanup() { __st=$?; rm -rf "$tmp"; exit $__st; }
>+trap cleanup 0
>+trap 'exit $?' 1 2 13 15
>+
>+tmp=$(mktemp -d --tmpdir annotate.XXXXXX) || exit 1
>+OUT=$tmp/out
>+ERR=$tmp/err
>
>-rm -f $OUT $ERR
> mkfifo $OUT $ERR || exit 1
>
> addtime O < $OUT &
>-- 
>1.7.12.rc2.16.g034161a
>

Actions: View | Diff

Attachments on bug 848022: 604260