Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <20190721045226.48772-1-samuel@sholland.org>
Date: Sat, 20 Jul 2019 23:52:26 -0500
From: Samuel Holland <samuel@...lland.org>
To: Rich Felker <dalias@...c.org>,
	musl@...ts.openwall.com
Cc: Samuel Holland <samuel@...lland.org>
Subject: [PATCH] use the correct stat structure in the fstat path

commit 01ae3fc6d48f4a45535189b7a6db286535af08ca modified fstatat to
translate the kernel's struct stat ("kstat") into the libc struct stat.
To do this, it created a local kstat object, and copied its contents
into the user-provided object.

However, the commit neglected to update the fstat compatibility path and
its fallbacks. They continued to pass the user-supplied object to the
kernel, later overwiting it with the uninitialized memory in the local
temporary.
---
 src/stat/fstatat.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/stat/fstatat.c b/src/stat/fstatat.c
index 7de75462..d915fa10 100644
--- a/src/stat/fstatat.c
+++ b/src/stat/fstatat.c
@@ -67,16 +67,16 @@ static int fstatat_kstat(int fd, const char *restrict path, struct stat *restric
 	struct kstat kst;
 
 	if (flag==AT_EMPTY_PATH && fd>=0 && !*path) {
-		ret = __syscall(SYS_fstat, fd, st);
+		ret = __syscall(SYS_fstat, fd, &kst);
 		if (ret==-EBADF && __syscall(SYS_fcntl, fd, F_GETFD)>=0) {
-			ret = __syscall(SYS_fstatat, fd, path, st, flag);
+			ret = __syscall(SYS_fstatat, fd, path, &kst, flag);
 			if (ret==-EINVAL) {
 				char buf[15+3*sizeof(int)];
 				__procfdname(buf, fd);
 #ifdef SYS_stat
-				ret = __syscall(SYS_stat, buf, st);
+				ret = __syscall(SYS_stat, buf, &kst);
 #else
-				ret = __syscall(SYS_fstatat, AT_FDCWD, buf, st, 0);
+				ret = __syscall(SYS_fstatat, AT_FDCWD, buf, &kst, 0);
 #endif
 			}
 		}
-- 
2.21.0

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.