vtorri
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Ecore Con: Fix possible timing attacks. 

Gist of it: we check, and then there's a window between our check and
the mkdir. We don't really need it anyway, because we just want to mkdir
and if it exists, just go on and do nothing.

CID 1039559
CID 1039558

@fix
This commit is contained in:
Tom Hacohen 2015-10-04 16:16:04 +01:00
parent 625eba7d0f
commit fa2ecb3af6
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/lib/ecore_con/ecore_con_local.c
View File

@ -219,7 +219,6 @@ ecore_con_local_listen(
struct linger lin;
mode_t pmode;
const char *homedir;
struct stat st;
mode_t mask;
int socket_unix_len;
Eina_Bool abstract_socket;
@ -244,15 +243,21 @@ ecore_con_local_listen(
#endif
mask = S_IRUSR | S_IWUSR | S_IXUSR;
snprintf(buf, sizeof(buf), "%s/.ecore", homedir);
if (stat(buf, &st) < 0)
if (mkdir(buf, mask) < 0)
{
if (mkdir(buf, mask) < 0) ERR("mkdir '%s' failed", buf);
if (errno != EEXIST)
{
ERR("mkdir '%s' failed", buf);
}
}
snprintf(buf, sizeof(buf), "%s/.ecore/%s", homedir, svr->name);
if (stat(buf, &st) < 0)
if (mkdir(buf, mask) < 0)
{
if (mkdir(buf, mask) < 0) ERR("mkdir '%s' failed", buf);
if (errno != EEXIST)
{
ERR("mkdir '%s' failed", buf);
}
}
if (svr->port < 0)