patch/trunk/19599883ffb6a450d2884f081f8ecf68edbed7ee.patch

   1 From 19599883ffb6a450d2884f081f8ecf68edbed7ee Mon Sep 17 00:00:00 2001
   2 From: Jean Delvare <jdelvare@suse.de>
   3 Date: Thu, 3 May 2018 14:31:55 +0200
   4 Subject: [PATCH] Don't leak temporary file on failed ed-style patch
   5
   6 Now that we write ed-style patches to a temporary file before we
   7 apply them, we need to ensure that the temporary file is removed
   8 before we leave, even on fatal error.
   9
  10 * src/pch.c (do_ed_script): Use global TMPEDNAME instead of local
  11   tmpname. Don't unlink the file directly, instead tag it for removal
  12   at exit time.
  13 * src/patch.c (cleanup): Unlink TMPEDNAME at exit.
  14
  15 This closes bug #53820:
  16 https://savannah.gnu.org/bugs/index.php?53820
  17
  18 Fixes: 123eaff0d5d1 ("Fix arbitrary command execution in ed-style patches (CVE-2018-1000156)")
  19 ---
  20  src/common.h |  2 ++
  21  src/patch.c  |  1 +
  22  src/pch.c    | 11 +++++------
  23  3 files changed, 8 insertions(+), 6 deletions(-)
  24
  25 diff --git a/src/common.h b/src/common.h
  26 index 904a3f8..53c5e32 100644
  27 --- a/src/common.h
  28 +++ b/src/common.h
  29 @@ -94,10 +94,12 @@ XTERN char const *origsuff;
  30  XTERN char const * TMPINNAME;
  31  XTERN char const * TMPOUTNAME;
  32  XTERN char const * TMPPATNAME;
  33 +XTERN char const * TMPEDNAME;
  34
  35  XTERN bool TMPINNAME_needs_removal;
  36  XTERN bool TMPOUTNAME_needs_removal;
  37  XTERN bool TMPPATNAME_needs_removal;
  38 +XTERN bool TMPEDNAME_needs_removal;
  39
  40  #ifdef DEBUGGING
  41  XTERN int debug;
  42 diff --git a/src/patch.c b/src/patch.c
  43 index 3fcaec5..9146597 100644
  44 --- a/src/patch.c
  45 +++ b/src/patch.c
  46 @@ -1999,6 +1999,7 @@ cleanup (void)
  47    remove_if_needed (TMPINNAME, &TMPINNAME_needs_removal);
  48    remove_if_needed (TMPOUTNAME, &TMPOUTNAME_needs_removal);
  49    remove_if_needed (TMPPATNAME, &TMPPATNAME_needs_removal);
  50 +  remove_if_needed (TMPEDNAME, &TMPEDNAME_needs_removal);
  51    remove_if_needed (TMPREJNAME, &TMPREJNAME_needs_removal);
  52    output_files (NULL);
  53  }
  54 diff --git a/src/pch.c b/src/pch.c
  55 index 79a3c99..1bb3153 100644
  56 --- a/src/pch.c
  57 +++ b/src/pch.c
  58 @@ -2396,7 +2396,6 @@ do_ed_script (char const *inname, char const *outname,
  59      file_offset beginning_of_this_line;
  60      size_t chars_read;
  61      FILE *tmpfp = 0;
  62 -    char const *tmpname;
  63      int tmpfd;
  64      pid_t pid;
  65
  66 @@ -2411,12 +2410,13 @@ do_ed_script (char const *inname, char const *outname,
  67            invalid commands and treats the next line as a new command, which
  68            can lead to arbitrary command execution.  */
  69
  70 -       tmpfd = make_tempfile (&tmpname, 'e', NULL, O_RDWR | O_BINARY, 0);
  71 +       tmpfd = make_tempfile (&TMPEDNAME, 'e', NULL, O_RDWR | O_BINARY, 0);
  72         if (tmpfd == -1)
  73 -         pfatal ("Can't create temporary file %s", quotearg (tmpname));
  74 +         pfatal ("Can't create temporary file %s", quotearg (TMPEDNAME));
  75 +       TMPEDNAME_needs_removal = true;
  76         tmpfp = fdopen (tmpfd, "w+b");
  77         if (! tmpfp)
  78 -         pfatal ("Can't open stream for file %s", quotearg (tmpname));
  79 +         pfatal ("Can't open stream for file %s", quotearg (TMPEDNAME));
  80        }
  81
  82      for (;;) {
  83 @@ -2457,7 +2457,7 @@ do_ed_script (char const *inname, char const *outname,
  84        write_fatal ();
  85
  86      if (lseek (tmpfd, 0, SEEK_SET) == -1)
  87 -      pfatal ("Can't rewind to the beginning of file %s", quotearg (tmpname));
  88 +      pfatal ("Can't rewind to the beginning of file %s", quotearg (TMPEDNAME));
  89
  90      if (inerrno != ENOENT)
  91        {
  92 @@ -2484,7 +2484,6 @@ do_ed_script (char const *inname, char const *outname,
  93        pfatal ("Failed to duplicate standard input");
  94
  95      fclose (tmpfp);
  96 -    safe_unlink (tmpname);
  97
  98      if (ofp)
  99        {