[Pkg-phototools-devel] Bug#612035: Ping: Bug#612035: Bug#612035: vulnerability: rewrite arbitrary user file

[Jonathan Wiltshire]

On Fri, Jul 08, 2011 at 08:06:17PM +0200, Julien Cristau wrote:
> On Fri, Jul  8, 2011 at 16:08:17 +0200, Andreas Tille wrote:
> 
> > @@ -275,7 +278,21 @@
> >           path = "";
> >     }
> >     else
> > -      path = "/tmp/";
> > +      snprintf(cppid, sizeof(cppid), "%06ld", (long) getpid());
> > +
> > +	while ((path == NULL) && (i < 9999)) {
> > +		snprintf(num, sizeof(num), "%06ld", i++);
> > +
> > +		path = estrjoin("", "/tmp/feh", "_", cppid, "_", num, "/", NULL);
> > +		if (mkdir(path, 0700) == -1) {
> > +			free(path);
> > +			path = NULL;
> > +		} else
> > +		opt.tmp_path = path;
> > +	}
> > +	if (path == NULL)
> > +		weprintf("Failed to create temporary directory:");
> > +
> >  
> >     basename = strrchr(url, '/') + 1;
> >     tmpname = feh_unique_filename(path, basename);
> 
> ick.  mkdtemp(3), please.
> 

Hi,

Any news on this?



-- 
Jonathan Wiltshire                                      jmw at debian.org
Debian Developer                         http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51