aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorMichael Tokarev <mjt@tls.msk.ru>2015-05-28 14:12:26 +0300
committerMichael Tokarev <mjt@tls.msk.ru>2015-06-03 14:21:45 +0300
commit8b8f1c7e9ddb2e88a144638f6527bf70e32343e3 (patch)
tree583cdca5f1cd0eae7e21d16a9a3ad3c78fda2a90 /net
parentb6b099541d6cf3c50b0fb5af916fff0db6508805 (diff)
downloadqemu-8b8f1c7e9ddb2e88a144638f6527bf70e32343e3.zip
qemu-8b8f1c7e9ddb2e88a144638f6527bf70e32343e3.tar.gz
qemu-8b8f1c7e9ddb2e88a144638f6527bf70e32343e3.tar.bz2
slirp: use less predictable directory name in /tmp for smb config (CVE-2015-4037)
In this version I used mkdtemp(3) which is: _BSD_SOURCE || /* Since glibc 2.10: */ (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700) (POSIX.1-2008), so should be available on systems we care about. While at it, reset the resulting directory name within smb structure on error so cleanup function wont try to remove directory which we failed to create. Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Markus Armbruster <armbru@redhat.com>
Diffstat (limited to 'net')
-rw-r--r--net/slirp.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/net/slirp.c b/net/slirp.c
index 0e15cf6..3533837 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s)
static int slirp_smb(SlirpState* s, const char *exported_dir,
struct in_addr vserver_addr)
{
- static int instance;
char smb_conf[128];
char smb_cmdline[128];
struct passwd *passwd;
@@ -505,10 +504,10 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
return -1;
}
- snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
- (long)getpid(), instance++);
- if (mkdir(s->smb_dir, 0700) < 0) {
+ snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.XXXXXX");
+ if (!mkdtemp(s->smb_dir)) {
error_report("could not create samba server dir '%s'", s->smb_dir);
+ s->smb_dir[0] = 0;
return -1;
}
snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");