Skip to content

Commit 3c1b60c

Browse files
author
Jakub Filak
committed
ccpp: save abrt core files only to new files
Prior this commit abrt-hook-ccpp saved a core file generated by a process running a program whose name starts with "abrt" in DUMP_LOCATION/$(basename program)-coredump. If the file was a symlink, the hook followed and wrote core file to the symlink's target. Addresses CVE-2015-5287 Signed-off-by: Jakub Filak <jfilak@redhat.com>
1 parent dec3089 commit 3c1b60c

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

Diff for: src/hooks/abrt-hook-ccpp.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -718,7 +718,8 @@ int main(int argc, char** argv)
718718
if (snprintf(path, sizeof(path), "%s/%s-coredump", g_settings_dump_location, last_slash) >= sizeof(path))
719719
error_msg_and_die("Error saving '%s': truncated long file path", path);
720720

721-
int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_TRUNC, 0600);
721+
unlink(path);
722+
int abrt_core_fd = xopen3(path, O_WRONLY | O_CREAT | O_EXCL, 0600);
722723
off_t core_size = copyfd_eof(STDIN_FILENO, abrt_core_fd, COPYFD_SPARSE);
723724
if (core_size < 0 || fsync(abrt_core_fd) != 0)
724725
{

0 commit comments

Comments
 (0)