Date: Fri, 29 May 2009 18:58:08 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Bruce Evans <bde@zeta.org.au> Cc: freebsd-hackers@FreeBSD.org, Jakub Lach <jakub_lach@mailplus.pl> Subject: Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability Message-ID: <86r5y7u9r3.fsf@ds4.des.no> In-Reply-To: <86vdnju9z1.fsf@ds4.des.no> ("Dag-Erling =?utf-8?Q?Sm=C3=B8rg?= =?utf-8?Q?rav=22's?= message of "Fri, 29 May 2009 18:53:22 %2B0200") References: <23727599.post@talk.nabble.com> <86prdvipwe.fsf@ds4.des.no> <20090527233110.E4243@delplex.bde.org> <86r5yaijef.fsf@ds4.des.no> <20090529210855.V1643@besplex.bde.org> <86vdnju9z1.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
How's this? Index: sys/kern/vfs_lookup.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- sys/kern/vfs_lookup.c (revision 193028) +++ sys/kern/vfs_lookup.c (working copy) @@ -454,7 +454,6 @@ int docache; /* =3D=3D 0 do not cache last component */ int wantparent; /* 1 =3D> wantparent or lockparent flag */ int rdonly; /* lookup read-only flag bit */ - int trailing_slash; int error =3D 0; int dpunlocked =3D 0; /* dp has already been unlocked */ struct componentname *cnp =3D &ndp->ni_cnd; @@ -529,12 +528,10 @@ * trailing slashes to handle symlinks, existing non-directories * and non-existing files that won't be directories specially later. */ - trailing_slash =3D 0; while (*cp =3D=3D '/' && (cp[1] =3D=3D '/' || cp[1] =3D=3D '\0')) { cp++; ndp->ni_pathlen--; if (*cp =3D=3D '\0') { - trailing_slash =3D 1; *ndp->ni_next =3D '\0'; /* XXX for direnter() ... */ cnp->cn_flags |=3D TRAILINGSLASH; } @@ -711,7 +708,7 @@ error =3D EROFS; goto bad; } - if (*cp =3D=3D '\0' && trailing_slash && + if (*cp =3D=3D '\0' && (cnp->cn_flags & TRAILINGSLASH) && !(cnp->cn_flags & WILLBEDIR)) { error =3D ENOENT; goto bad; @@ -788,7 +785,7 @@ * Check for symbolic link */ if ((dp->v_type =3D=3D VLNK) && - ((cnp->cn_flags & FOLLOW) || trailing_slash || + ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || *ndp->ni_next =3D=3D '/')) { cnp->cn_flags |=3D ISSYMLINK; if (dp->v_iflag & VI_DOOMED) { BTW, what does the "XXX for direnter()" comment mean? DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86r5y7u9r3.fsf>