aboutsummaryrefslogtreecommitdiff
path: root/posix/spawn_faction_addopen.c
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2014-06-11 23:12:52 +0200
committerFlorian Weimer <fweimer@redhat.com>2014-06-11 23:13:42 +0200
commit89e435f3559c53084498e9baad22172b64429362 (patch)
tree6bd069da0346ea8cb18e506b8e10252bc3a8b33a /posix/spawn_faction_addopen.c
parentc3a2ebe1f7541cc35937621e08c28ff88afd0845 (diff)
downloadglibc-89e435f3559c53084498e9baad22172b64429362.tar
glibc-89e435f3559c53084498e9baad22172b64429362.tar.gz
glibc-89e435f3559c53084498e9baad22172b64429362.tar.bz2
glibc-89e435f3559c53084498e9baad22172b64429362.zip
posix_spawn_file_actions_addopen needs to copy the path argument (BZ 17048)
POSIX requires that we make a copy, so we allocate a new string and free it in posix_spawn_file_actions_destroy. Reported by David Reid, Alex Gaynor, and Glyph Lefkowitz. This bug may have security implications.
Diffstat (limited to 'posix/spawn_faction_addopen.c')
-rw-r--r--posix/spawn_faction_addopen.c13
1 files changed, 10 insertions, 3 deletions
diff --git a/posix/spawn_faction_addopen.c b/posix/spawn_faction_addopen.c
index 47f62425b6..40800b8e6e 100644
--- a/posix/spawn_faction_addopen.c
+++ b/posix/spawn_faction_addopen.c
@@ -35,17 +35,24 @@ posix_spawn_file_actions_addopen (posix_spawn_file_actions_t *file_actions,
if (fd < 0 || fd >= maxfd)
return EBADF;
+ char *path_copy = strdup (path);
+ if (path_copy == NULL)
+ return ENOMEM;
+
/* Allocate more memory if needed. */
if (file_actions->__used == file_actions->__allocated
&& __posix_spawn_file_actions_realloc (file_actions) != 0)
- /* This can only mean we ran out of memory. */
- return ENOMEM;
+ {
+ /* This can only mean we ran out of memory. */
+ free (path_copy);
+ return ENOMEM;
+ }
/* Add the new value. */
rec = &file_actions->__actions[file_actions->__used];
rec->tag = spawn_do_open;
rec->action.open_action.fd = fd;
- rec->action.open_action.path = path;
+ rec->action.open_action.path = path_copy;
rec->action.open_action.oflag = oflag;
rec->action.open_action.mode = mode;