Attachment 13115 Details for Bug 42865

[patch] my patch II

ImageMagick-5.5.4-tmpfile.patch (text/plain), 2.56 KB, created by Vladimir Nadvornik on 2003-07-15 22:18:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Vladimir Nadvornik

Created: 2003-07-15 22:18:11 UTC

Size: 2.56 KB

patch

obsolete

>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0455
>    The imagemagick libmagick library 5.5 and earlier creates temporary
>    files insecurely, which allows local users to create or overwrite
>    arbitrary files.
>
>this patch based on Daniel Kobras code to fix insecure temporary
>file creation which is mentioned in http://www.debian.org/security/2003/dsa-331
>ported because added randomness just makes the race condition harder to
>achieve, but not impossible.
>
>================================================================================
>--- magick/utility.c
>+++ magick/utility.c
>@@ -2644,8 +2644,53 @@
> %      name is returned in this array.
> %
> */
>+
>+/* Attention: this creates an additional 
>+ * intermediate directory for security reasons,
>+ * but unfortunately it is never deleted.
>+ */
>+static void TemporaryFilenameHelper(char *, char *);
> MagickExport void TemporaryFilename(char *path)
> {
>+    static char *mSafeTmpdir = NULL;
>+    char *name;
>+    struct passwd *pwd;
>+    struct stat st;
>+    char *tmpdir = getenv("TMPDIR");
>+    if (tmpdir == NULL)
>+	tmpdir = P_tmpdir;
>+	
>+    pwd = getpwuid (getuid ());
>+	
>+    if (mSafeTmpdir == NULL) {
>+	FormatString(path, "%s/magick-%s", tmpdir, pwd->pw_name);
>+
>+        if (lstat (path, &st) == 0) {
>+	    if (S_ISDIR (st.st_mode) && 
>+		st.st_uid == getuid () &&
>+		chmod (path, 0700) == 0) {
>+		
>+            	mSafeTmpdir = strdup(path);
>+	    }
>+	    else 
>+        	MagickFatalError(ResourceLimitFatalError,"TempDirHasWrongPermissions",path);
>+	} else {
>+    	    if (mkdir(path, S_IRWXU) == 0) {
>+                mSafeTmpdir = strdup(path);
>+    	    }
>+	    else
>+        	MagickFatalError(ResourceLimitFatalError,"CantCreateTempDir",path);
>+	}
>+    }
>+    path[0] = '\0';
>+    if (mSafeTmpdir == NULL)
>+        return;
>+
>+    TemporaryFilenameHelper(path, mSafeTmpdir);
>+}
>+
>+static void TemporaryFilenameHelper(char *path, char *mSafeTmpdir)
>+{
> #define RandomKeyExtent  6
> 
>   char
>@@ -2670,24 +2715,9 @@
>     /*
>       Get temporary pathname.
>     */
>-    (void) strcpy(path,"magic");
>-#if defined(vms) || defined(macintosh)
>-    (void) tmpnam(path);
>-#else
>-    {
>-      char
>-        *name;
>+    (void) strcpy(path, mSafeTmpdir);
>+    strncat(path, "/magick", MaxTextExtent-strlen(path)-1); 
> 
>-      name=(char *) tempnam((char *) NULL,path);
>-      if (name == (char *) NULL)
>-        (void) tmpnam(path);
>-      else
>-        {
>-          (void) strncpy(path,name,MaxTextExtent-1);
>-          LiberateMemory((void **) &name);
>-        }
>-    }
>-#endif
>     /*
>       Add salt to strengthen weak tmpnam()/tempnam() implementations.
>     */

Actions: View | Diff

Attachments on bug 42865: 13080 | 13081 | 13085 | 13098 | 13115