aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMaxim Konovalov <maxim@FreeBSD.org>2005-06-10 16:43:25 +0000
committerMaxim Konovalov <maxim@FreeBSD.org>2005-06-10 16:43:25 +0000
commit609fd3652ebd63cac2f7260fb879c2b33d87c1ad (patch)
treefcbd93f444fc557411db21ab71ca67f2eeba8ce3
parent195deabf744128e6305e9d0926a7567d99b020ff (diff)
downloadsrc-609fd3652ebd63cac2f7260fb879c2b33d87c1ad.tar.gz
src-609fd3652ebd63cac2f7260fb879c2b33d87c1ad.zip
o Merge SA-05:11.gzip.
Approved by: so (cperciva)
Notes
Notes: svn path=/releng/4.9/; revision=147255
-rw-r--r--UPDATING3
-rw-r--r--gnu/usr.bin/gzip/gzip.c18
-rw-r--r--sys/conf/newvers.sh2
3 files changed, 14 insertions, 9 deletions
diff --git a/UPDATING b/UPDATING
index a0fc60583253..5ef4b00fd5d1 100644
--- a/UPDATING
+++ b/UPDATING
@@ -17,6 +17,9 @@ minimal number of processes, if possible, for that patch. For those
updates that don't have an advisory, or to be safe, you can do a full
build and install as described in the COMMON ITEMS section.
+20050610: p18 FreeBSD-SA-05:11.gzip
+ Correct directory traversal and race condition vulnerabilities in gzip.
+
20050512: p17 FreeBSD-SA-05:06.iir, FreeBSD-SA-05:07.ldt,
FreeBSD-SA-05:08.kmem
Correct overly liberal permissions on /dev/iir.
diff --git a/gnu/usr.bin/gzip/gzip.c b/gnu/usr.bin/gzip/gzip.c
index b59b4d1a7a4c..e38353eab087 100644
--- a/gnu/usr.bin/gzip/gzip.c
+++ b/gnu/usr.bin/gzip/gzip.c
@@ -830,8 +830,11 @@ local void treat_file(iname)
}
close(ifd);
- if (!to_stdout && close(ofd)) {
- write_error();
+ if (!to_stdout) {
+ /* Copy modes, times, ownership, and remove the input file */
+ copy_stat(&istat);
+ if (close(ofd))
+ write_error();
}
if (method == -1) {
if (!to_stdout) unlink (ofname);
@@ -851,10 +854,6 @@ local void treat_file(iname)
}
fprintf(stderr, "\n");
}
- /* Copy modes, times, ownership, and remove the input file */
- if (!to_stdout) {
- copy_stat(&istat);
- }
}
/* ========================================================================
@@ -1257,6 +1256,7 @@ local int get_method(in)
/* Copy the base name. Keep a directory prefix intact. */
char *p = basename(ofname);
char *base = p;
+ char *base2;
for (;;) {
*p = (char)get_char();
if (*p++ == '\0') break;
@@ -1264,6 +1264,8 @@ local int get_method(in)
error("corrupted input -- file name too large");
}
}
+ base2 = basename (base);
+ strcpy(base, base2);
/* If necessary, adapt the name to local OS conventions: */
if (!list) {
MAKE_LEGAL_NAME(base);
@@ -1636,12 +1638,12 @@ local void copy_stat(ifstat)
reset_times(ofname, ifstat);
#endif
/* Copy the protection modes */
- if (chmod(ofname, ifstat->st_mode & 07777)) {
+ if (fchmod(ofd, ifstat->st_mode & 07777)) {
WARN((stderr, "%s: ", progname));
if (!quiet) perror(ofname);
}
#ifndef NO_CHOWN
- chown(ofname, ifstat->st_uid, ifstat->st_gid); /* Copy ownership */
+ (void) fchown(ofd, ifstat->st_uid, ifstat->st_gid); /* Copy ownership */
#endif
remove_ofname = 0;
/* It's now safe to remove the input file: */
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 4831756be276..741455b47b70 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -36,7 +36,7 @@
TYPE="FreeBSD"
REVISION="4.9"
-BRANCH="RELEASE-p17"
+BRANCH="RELEASE-p18"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"