falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

9pfs: local: statfs: don't follow symlinks 

The local_statfs() callback is vulnerable to symlink attacks because it
calls statfs() which follows symbolic links in all path elements.

This patch converts local_statfs() to rely on open_nofollow() and fstatfs()
instead.

This partly fixes CVE-2016-9602.

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 31e51d1c15)
Signed-off-by: Greg Kurz <gkurz@linux.vnet.ibm.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
This commit is contained in:
Greg Kurz 2017-02-26 23:43:25 +01:00 committed by Michael Roth
parent 91225c670a
commit d3c54bf9e7
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
hw/9pfs/9p-local.c
View File

@ -1078,13 +1078,11 @@ static int local_fsync(FsContext *ctx, int fid_type,
static int local_statfs(FsContext *s, V9fsPath *fs_path, struct statfs *stbuf) static int local_statfs(FsContext *s, V9fsPath *fs_path, struct statfs *stbuf)
{ {
char *buffer; int fd, ret;
int ret;
char *path = fs_path->data;
buffer = rpath(s, path); fd = local_open_nofollow(s, fs_path->data, O_RDONLY, 0);
ret = statfs(buffer, stbuf); ret = fstatfs(fd, stbuf);
g_free(buffer); close_preserve_errno(fd);
return ret; return ret;
} }