diff options
author | Greg Kurz <groug@kaod.org> | 2017-02-26 23:43:32 +0100 |
---|---|---|
committer | Greg Kurz <groug@kaod.org> | 2017-02-28 11:21:15 +0100 |
commit | ac125d993b461d4dee4d6df4d93ac3f2eb959d1d (patch) | |
tree | 09c9cf74e1afda864a5c387c5ff109a0a34b1527 /hw | |
parent | 31e51d1c15b35dc98b88a301812914b70a2b55dc (diff) | |
download | qemu-ac125d993b461d4dee4d6df4d93ac3f2eb959d1d.zip qemu-ac125d993b461d4dee4d6df4d93ac3f2eb959d1d.tar.gz qemu-ac125d993b461d4dee4d6df4d93ac3f2eb959d1d.tar.bz2 |
9pfs: local: truncate: don't follow symlinks
The local_truncate() callback is vulnerable to symlink attacks because
it calls truncate() which follows symbolic links in all path elements.
This patch converts local_truncate() to rely on open_nofollow() and
ftruncate() instead.
This partly fixes CVE-2016-9602.
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw')
-rw-r--r-- | hw/9pfs/9p-local.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c index 95b2c1c..1a3dfd7 100644 --- a/hw/9pfs/9p-local.c +++ b/hw/9pfs/9p-local.c @@ -894,13 +894,14 @@ err_out: static int local_truncate(FsContext *ctx, V9fsPath *fs_path, off_t size) { - char *buffer; - int ret; - char *path = fs_path->data; + int fd, ret; - buffer = rpath(ctx, path); - ret = truncate(buffer, size); - g_free(buffer); + fd = local_open_nofollow(ctx, fs_path->data, O_WRONLY, 0); + if (fd == -1) { + return -1; + } + ret = ftruncate(fd, size); + close_preserve_errno(fd); return ret; } |