File CVE-2015-4037-qemuu-smb-config-dir-name.patch of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File CVE-2015-4037-qemuu-smb-config-dir-name.patch of Package xen (Revision fe1d1744a8ed7820af5694febca8c8fd)

Currently displaying revision fe1d1744a8ed7820af5694febca8c8fd , Show latest

References: bsc#932267

Subject: slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
From: Michael Tokarev mjt@tls.msk.ru Thu May 28 14:12:26 2015 +0300
Date: Wed Jun 3 14:21:45 2015 +0300:
Git: 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3

In this version I used mkdtemp(3) which is:

_BSD_SOURCE
        || /* Since glibc 2.10: */
            (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)

(POSIX.1-2008), so should be available on systems we care about.

While at it, reset the resulting directory name within smb structure
on error so cleanup function wont try to remove directory which we
failed to create.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Markus Armbruster <armbru@redhat.com>

Index: xen-4.4.3-testing/tools/qemu-xen-dir-remote/net/slirp.c
===================================================================
--- xen-4.4.3-testing.orig/tools/qemu-xen-dir-remote/net/slirp.c
+++ xen-4.4.3-testing/tools/qemu-xen-dir-remote/net/slirp.c
@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState
 static int slirp_smb(SlirpState* s, const char *exported_dir,
                      struct in_addr vserver_addr)
 {
-    static int instance;
     char smb_conf[128];
     char smb_cmdline[128];
     struct passwd *passwd;
@@ -505,10 +504,10 @@ static int slirp_smb(SlirpState* s, cons
         return -1;
     }
 
-    snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
-             (long)getpid(), instance++);
-    if (mkdir(s->smb_dir, 0700) < 0) {
+    snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.XXXXXX");
+    if (!mkdtemp(s->smb_dir)) {
         error_report("could not create samba server dir '%s'", s->smb_dir);
+        s->smb_dir[0] = 0;
         return -1;
     }
     snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");

Places

File CVE-2015-4037-qemuu-smb-config-dir-name.patch of Package xen (Revision fe1d1744a8ed7820af5694febca8c8fd)

Places