Date: Fri, 29 May 2009 18:53:22 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Bruce Evans <bde@zeta.org.au> Cc: freebsd-hackers@FreeBSD.org, Jakub Lach <jakub_lach@mailplus.pl> Subject: Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability Message-ID: <86vdnju9z1.fsf@ds4.des.no> In-Reply-To: <20090529210855.V1643@besplex.bde.org> (Bruce Evans's message of "Sat, 30 May 2009 02:01:47 %2B1000 (EST)") References: <23727599.post@talk.nabble.com> <86prdvipwe.fsf@ds4.des.no> <20090527233110.E4243@delplex.bde.org> <86r5yaijef.fsf@ds4.des.no> <20090529210855.V1643@besplex.bde.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Bruce Evans <bde@zeta.org.au> writes:
> Dag-Erling Smørgrav <des@des.no> writes:
> % Index: sys/kern/vfs_lookup.c
> % ===================================================================
> % --- sys/kern/vfs_lookup.c (revision 192899)
> % +++ sys/kern/vfs_lookup.c (working copy)
> % @@ -147,6 +147,9 @@
> % cnp->cn_flags &= ~LOCKSHARED;
> % fdp = p->p_fd;
> % % + /* We will set this ourselves if we need it. */
> % + cnp->cn_flags &= ~TRAILINGSLASH;
> % +
>
> Can TRAILINGSLASH ever be set here? Is namei() ever called recursively?
"suspenders and a belt"
It is hypothetically possible for the caller to have set it.
> % /*
> % * Get a buffer for the name to be translated, and copy the
> % * name into the buffer.
> % @@ -533,6 +536,8 @@
> % if (*cp == '\0') {
> % trailing_slash = 1;
>
> I thought at first that this flag can go away.
I intend to remove it later - I just wanted to get the bug fixed first.
I'm happy to hear that removing it will fix the two bugs introduced by
the patch I committed :)
DES
--
Dag-Erling Smørgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86vdnju9z1.fsf>