Commit24aed21

committed

Restrict file mode creation mask during tmpfile().

Per Coverity. Back-patch to 9.0 (all supported versions).Michael Paquier, reviewed (in earlier versions) by Heikki Linnakangas.

1 parenteed5bbc commit24aed21Copy full SHA for 24aed21

File tree

+12

-0

lines changed

+12

-0

lines changed

Lines changed: 12 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -375,8 +375,18 @@ tarOpen(ArchiveHandle AH, const char filename, char mode)`
`375`	`375`	`}`
`376`	`376`	`else`
`377`	`377`	`{`
	`378`	`+intold_umask;`
	`379`	`+`
`378`	`380`	`tm=calloc(1,sizeof(TAR_MEMBER));`
`379`	`381`
	`382`	`+/*`
	`383`	`+ * POSIX does not require, but permits, tmpfile() to restrict file`
	`384`	`+ * permissions. Given an OS crash after we write data, the filesystem`
	`385`	`+ * might retain the data but forget tmpfile()'s unlink(). If so, the`
	`386`	`+ * file mode protects confidentiality of the data written.`
	`387`	`+ */`
	`388`	`+old_umask=umask(S_IRWXG \|S_IRWXO);`
	`389`	`+`
`380`	`390`	`#ifndefWIN32`
`381`	`391`	`tm->tmpFH=tmpfile();`
`382`	`392`	`#else`
`@@ -411,6 +421,8 @@ tarOpen(ArchiveHandle AH, const char filename, char mode)`
`411`	`421`	`if (tm->tmpFH==NULL)`
`412`	`422`	`die_horribly(AH,modulename,"could not generate temporary file name: %s\n",strerror(errno));`
`413`	`423`
	`424`	`+umask(old_umask);`
	`425`	`+`
`414`	`426`	`#ifdefHAVE_LIBZ`
`415`	`427`
`416`	`428`	`if (AH->compression!=0)`

Comments

(0)