Attachment 13085 Details for Bug 42865

[patch] the debian patch

imagemagick.patch (text/plain), 1.48 KB, created by Vladimir Nadvornik on 2003-07-11 21:18:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vladimir Nadvornik

Created: 2003-07-11 21:18:22 UTC

Size: 1.48 KB

patch

obsolete

>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0455
>    The imagemagick libmagick library 5.5 and earlier creates temporary
>    files insecurely, which allows local users to create or overwrite
>    arbitrary files.
>
>this patch based on Daniel Kobras code to fix insecure temporary
>file creation which is mentioned in http://www.debian.org/security/2003/dsa-331
>ported because added randomness just makes the race condition harder to
>achieve, but not impossible.
>
>--- magick/utility.c.orig	Fri Dec 13 16:34:24 2002
>+++ magick/utility.c	Thu Jul 10 15:20:20 2003
>@@ -3258,7 +3258,37 @@
> %      name is returned in this array.
> %
> */
>+
>+/* Attention: this creates an additional 
>+ * intermediate directory for security reasons,
>+ * but unfortunately it is never deleted.
>+ */
>+static void TemporaryFilenameHelper(char *);
> MagickExport void TemporaryFilename(char *path)
>+{
>+    static char *mSafeTmpdir = NULL;
>+    char *name;
>+
>+    path[0] = '\0';
>+    if (mSafeTmpdir == NULL) {
>+        do {
>+            TemporaryFilenameHelper(path);
>+            if (mkdir(path, S_IRWXU) == 0) {
>+                mSafeTmpdir = strdup(path);
>+                break;
>+            }
>+        } while (errno == EEXIST);
>+    }
>+    if (mSafeTmpdir == NULL)
>+        return;
>+    if ((name = tempnam(mSafeTmpdir, (char *)NULL)) == NULL)
>+        return;
>+    (void)strncpy(path, name, MaxTextExtent-1);
>+    free(name);
>+    return;
>+}
>+
>+static void TemporaryFilenameHelper(char *path)
> {
> #define RandomKeyExtent  6
>

Actions: View | Diff

Attachments on bug 42865: 13080 | 13081 | 13085 | 13098 | 13115