Date: Fri, 29 May 2009 18:58:08 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Bruce Evans <bde@zeta.org.au> Cc: freebsd-hackers@FreeBSD.org, Jakub Lach <jakub_lach@mailplus.pl> Subject: Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability Message-ID: <86r5y7u9r3.fsf@ds4.des.no> In-Reply-To: <86vdnju9z1.fsf@ds4.des.no> ("Dag-Erling =?utf-8?Q?Sm=C3=B8rg?= =?utf-8?Q?rav=22's?= message of "Fri, 29 May 2009 18:53:22 %2B0200") References: <23727599.post@talk.nabble.com> <86prdvipwe.fsf@ds4.des.no> <20090527233110.E4243@delplex.bde.org> <86r5yaijef.fsf@ds4.des.no> <20090529210855.V1643@besplex.bde.org> <86vdnju9z1.fsf@ds4.des.no>
next in thread | previous in thread | raw e-mail | index | archive | help
How's this?
Index: sys/kern/vfs_lookup.c
===================================================================
--- sys/kern/vfs_lookup.c (revision 193028)
+++ sys/kern/vfs_lookup.c (working copy)
@@ -454,7 +454,6 @@
int docache; /* == 0 do not cache last component */
int wantparent; /* 1 => wantparent or lockparent flag */
int rdonly; /* lookup read-only flag bit */
- int trailing_slash;
int error = 0;
int dpunlocked = 0; /* dp has already been unlocked */
struct componentname *cnp = &ndp->ni_cnd;
@@ -529,12 +528,10 @@
* trailing slashes to handle symlinks, existing non-directories
* and non-existing files that won't be directories specially later.
*/
- trailing_slash = 0;
while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) {
cp++;
ndp->ni_pathlen--;
if (*cp == '\0') {
- trailing_slash = 1;
*ndp->ni_next = '\0'; /* XXX for direnter() ... */
cnp->cn_flags |= TRAILINGSLASH;
}
@@ -711,7 +708,7 @@
error = EROFS;
goto bad;
}
- if (*cp == '\0' && trailing_slash &&
+ if (*cp == '\0' && (cnp->cn_flags & TRAILINGSLASH) &&
!(cnp->cn_flags & WILLBEDIR)) {
error = ENOENT;
goto bad;
@@ -788,7 +785,7 @@
* Check for symbolic link
*/
if ((dp->v_type == VLNK) &&
- ((cnp->cn_flags & FOLLOW) || trailing_slash ||
+ ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) ||
*ndp->ni_next == '/')) {
cnp->cn_flags |= ISSYMLINK;
if (dp->v_iflag & VI_DOOMED) {
BTW, what does the "XXX for direnter()" comment mean?
DES
--
Dag-Erling Smørgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86r5y7u9r3.fsf>