From 7f770b9c20da1a192dad8cb572a6391f2773285a Mon Sep 17 00:00:00 2001 From: Jean Delvare Date: Thu, 3 May 2018 14:31:55 +0200 Subject: [PATCH 1/2] Don't leak temporary file on failed ed-style patch Now that we write ed-style patches to a temporary file before we apply them, we need to ensure that the temporary file is removed before we leave, even on fatal error. * src/pch.c (do_ed_script): Use global TMPEDNAME instead of local tmpname. Don't unlink the file directly, instead tag it for removal at exit time. * src/patch.c (cleanup): Unlink TMPEDNAME at exit. This closes bug #53820: https://savannah.gnu.org/bugs/index.php?53820 Fixes: 123eaff0d5d1 ("Fix arbitrary command execution in ed-style patches (CVE-2018-1000156)") CVE: CVE-2018-1000156 Upstream-Status: Backport [http://git.savannah.gnu.org/cgit/patch.git/commit/?id=19599883ffb6a450d2884f081f8ecf68edbed7ee] Signed-off-by: Anuj Mittal --- src/common.h | 2 ++ src/pch.c | 12 +++++------- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/common.h b/src/common.h index ec50b40..22238b5 100644 --- a/src/common.h +++ b/src/common.h @@ -94,10 +94,12 @@ XTERN char const *origsuff; XTERN char const * TMPINNAME; XTERN char const * TMPOUTNAME; XTERN char const * TMPPATNAME; +XTERN char const * TMPEDNAME; XTERN bool TMPINNAME_needs_removal; XTERN bool TMPOUTNAME_needs_removal; XTERN bool TMPPATNAME_needs_removal; +XTERN bool TMPEDNAME_needs_removal; #ifdef DEBUGGING XTERN int debug; diff --git a/src/pch.c b/src/pch.c index 16e001a..c1a62cf 100644 --- a/src/pch.c +++ b/src/pch.c @@ -2392,7 +2392,6 @@ do_ed_script (char const *inname, char const *outname, file_offset beginning_of_this_line; size_t chars_read; FILE *tmpfp = 0; - char const *tmpname; int tmpfd; pid_t pid; @@ -2404,12 +2403,13 @@ do_ed_script (char const *inname, char const *outname, invalid commands and treats the next line as a new command, which can lead to arbitrary command execution. */ - tmpfd = make_tempfile (&tmpname, 'e', NULL, O_RDWR | O_BINARY, 0); + tmpfd = make_tempfile (&TMPEDNAME, 'e', NULL, O_RDWR | O_BINARY, 0); if (tmpfd == -1) - pfatal ("Can't create temporary file %s", quotearg (tmpname)); + pfatal ("Can't create temporary file %s", quotearg (TMPEDNAME)); + TMPEDNAME_needs_removal = true; tmpfp = fdopen (tmpfd, "w+b"); if (! tmpfp) - pfatal ("Can't open stream for file %s", quotearg (tmpname)); + pfatal ("Can't open stream for file %s", quotearg (TMPEDNAME)); } for (;;) { @@ -2449,8 +2449,7 @@ do_ed_script (char const *inname, char const *outname, write_fatal (); if (lseek (tmpfd, 0, SEEK_SET) == -1) - pfatal ("Can't rewind to the beginning of file %s", quotearg (tmpname)); - + pfatal ("Can't rewind to the beginning of file %s", quotearg (TMPEDNAME)); if (! dry_run && ! skip_rest_of_patch) { int exclusive = *outname_needs_removal ? 0 : O_EXCL; *outname_needs_removal = true; @@ -2482,7 +2481,6 @@ do_ed_script (char const *inname, char const *outname, } fclose (tmpfp); - safe_unlink (tmpname); if (ofp) { -- 2.17.0