aboutsummaryrefslogtreecommitdiffstats
path: root/usr/gen_init_cpio.c
diff options
context:
space:
mode:
authorJesper Juhl <jj@chaosbits.net>2010-12-24 15:28:56 -0500
committerMichal Marek <mmarek@suse.cz>2010-12-29 09:06:54 -0500
commit96aebafa63418f447ddc823e40da341cc40553dd (patch)
tree1e92e6de97eb77c20807557b98d08822c34b58d4 /usr/gen_init_cpio.c
parent731ece41fb1047816303295a0cdfed90a528137e (diff)
gen_init_cpio: Avoid race between call to stat() and call to open()
In usr/gen_init_cpio.c::cpio_mkfile() a call to stat() is made based on pathname, subsequently the file is open()'ed and then the value of the initial stat() call is used to allocate a buffer. This is not safe since the file may change between the call to stat() and the call to open(). Safer to just open() the file and then do fstat() using the filedescriptor returned by open. Signed-off-by: Jesper Juhl <jj@chaosbits.net> Acked-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Michal Marek <mmarek@suse.cz>
Diffstat (limited to 'usr/gen_init_cpio.c')
-rw-r--r--usr/gen_init_cpio.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
index 59df70d9d1dc..f463cafdccb2 100644
--- a/usr/gen_init_cpio.c
+++ b/usr/gen_init_cpio.c
@@ -309,18 +309,18 @@ static int cpio_mkfile(const char *name, const char *location,
309 309
310 mode |= S_IFREG; 310 mode |= S_IFREG;
311 311
312 retval = stat (location, &buf);
313 if (retval) {
314 fprintf (stderr, "File %s could not be located\n", location);
315 goto error;
316 }
317
318 file = open (location, O_RDONLY); 312 file = open (location, O_RDONLY);
319 if (file < 0) { 313 if (file < 0) {
320 fprintf (stderr, "File %s could not be opened for reading\n", location); 314 fprintf (stderr, "File %s could not be opened for reading\n", location);
321 goto error; 315 goto error;
322 } 316 }
323 317
318 retval = fstat (file, &buf);
319 if (retval) {
320 fprintf (stderr, "File %s could not be stat()'ed\n", location);
321 goto error;
322 }
323
324 filebuf = malloc(buf.st_size); 324 filebuf = malloc(buf.st_size);
325 if (!filebuf) { 325 if (!filebuf) {
326 fprintf (stderr, "out of memory\n"); 326 fprintf (stderr, "out of memory\n");