|
|
@@ -0,0 +1,93 @@
|
|
|
+From 7f770b9c20da1a192dad8cb572a6391f2773285a Mon Sep 17 00:00:00 2001
|
|
|
+From: Jean Delvare <jdelvare@suse.de>
|
|
|
+Date: Thu, 3 May 2018 14:31:55 +0200
|
|
|
+Subject: [PATCH 1/2] Don't leak temporary file on failed ed-style patch
|
|
|
+
|
|
|
+Now that we write ed-style patches to a temporary file before we
|
|
|
+apply them, we need to ensure that the temporary file is removed
|
|
|
+before we leave, even on fatal error.
|
|
|
+
|
|
|
+* src/pch.c (do_ed_script): Use global TMPEDNAME instead of local
|
|
|
+ tmpname. Don't unlink the file directly, instead tag it for removal
|
|
|
+ at exit time.
|
|
|
+* src/patch.c (cleanup): Unlink TMPEDNAME at exit.
|
|
|
+
|
|
|
+This closes bug #53820:
|
|
|
+https://savannah.gnu.org/bugs/index.php?53820
|
|
|
+
|
|
|
+Fixes: 123eaff0d5d1 ("Fix arbitrary command execution in ed-style patches (CVE-2018-1000156)")
|
|
|
+
|
|
|
+Upstream-Status: Backport [http://git.savannah.gnu.org/cgit/patch.git/commit/?id=19599883ffb6a450d2884f081f8ecf68edbed7ee]
|
|
|
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
|
|
|
+---
|
|
|
+ src/common.h | 2 ++
|
|
|
+ src/pch.c | 12 +++++-------
|
|
|
+ 2 files changed, 7 insertions(+), 7 deletions(-)
|
|
|
+
|
|
|
+diff --git a/src/common.h b/src/common.h
|
|
|
+index ec50b40..22238b5 100644
|
|
|
+--- a/src/common.h
|
|
|
++++ b/src/common.h
|
|
|
+@@ -94,10 +94,12 @@ XTERN char const *origsuff;
|
|
|
+ XTERN char const * TMPINNAME;
|
|
|
+ XTERN char const * TMPOUTNAME;
|
|
|
+ XTERN char const * TMPPATNAME;
|
|
|
++XTERN char const * TMPEDNAME;
|
|
|
+
|
|
|
+ XTERN bool TMPINNAME_needs_removal;
|
|
|
+ XTERN bool TMPOUTNAME_needs_removal;
|
|
|
+ XTERN bool TMPPATNAME_needs_removal;
|
|
|
++XTERN bool TMPEDNAME_needs_removal;
|
|
|
+
|
|
|
+ #ifdef DEBUGGING
|
|
|
+ XTERN int debug;
|
|
|
+diff --git a/src/pch.c b/src/pch.c
|
|
|
+index 16e001a..c1a62cf 100644
|
|
|
+--- a/src/pch.c
|
|
|
++++ b/src/pch.c
|
|
|
+@@ -2392,7 +2392,6 @@ do_ed_script (char const *inname, char const *outname,
|
|
|
+ file_offset beginning_of_this_line;
|
|
|
+ size_t chars_read;
|
|
|
+ FILE *tmpfp = 0;
|
|
|
+- char const *tmpname;
|
|
|
+ int tmpfd;
|
|
|
+ pid_t pid;
|
|
|
+
|
|
|
+@@ -2404,12 +2403,13 @@ do_ed_script (char const *inname, char const *outname,
|
|
|
+ invalid commands and treats the next line as a new command, which
|
|
|
+ can lead to arbitrary command execution. */
|
|
|
+
|
|
|
+- tmpfd = make_tempfile (&tmpname, 'e', NULL, O_RDWR | O_BINARY, 0);
|
|
|
++ tmpfd = make_tempfile (&TMPEDNAME, 'e', NULL, O_RDWR | O_BINARY, 0);
|
|
|
+ if (tmpfd == -1)
|
|
|
+- pfatal ("Can't create temporary file %s", quotearg (tmpname));
|
|
|
++ pfatal ("Can't create temporary file %s", quotearg (TMPEDNAME));
|
|
|
++ TMPEDNAME_needs_removal = true;
|
|
|
+ tmpfp = fdopen (tmpfd, "w+b");
|
|
|
+ if (! tmpfp)
|
|
|
+- pfatal ("Can't open stream for file %s", quotearg (tmpname));
|
|
|
++ pfatal ("Can't open stream for file %s", quotearg (TMPEDNAME));
|
|
|
+ }
|
|
|
+
|
|
|
+ for (;;) {
|
|
|
+@@ -2449,8 +2449,7 @@ do_ed_script (char const *inname, char const *outname,
|
|
|
+ write_fatal ();
|
|
|
+
|
|
|
+ if (lseek (tmpfd, 0, SEEK_SET) == -1)
|
|
|
+- pfatal ("Can't rewind to the beginning of file %s", quotearg (tmpname));
|
|
|
+-
|
|
|
++ pfatal ("Can't rewind to the beginning of file %s", quotearg (TMPEDNAME));
|
|
|
+ if (! dry_run && ! skip_rest_of_patch) {
|
|
|
+ int exclusive = *outname_needs_removal ? 0 : O_EXCL;
|
|
|
+ *outname_needs_removal = true;
|
|
|
+@@ -2482,7 +2481,6 @@ do_ed_script (char const *inname, char const *outname,
|
|
|
+ }
|
|
|
+
|
|
|
+ fclose (tmpfp);
|
|
|
+- safe_unlink (tmpname);
|
|
|
+
|
|
|
+ if (ofp)
|
|
|
+ {
|
|
|
+--
|
|
|
+2.17.0
|
|
|
+
|
Anuj Mittal