mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-02-02 11:09:29 +00:00
Code Issues Releases Activity

unzip TOCTOU file-permissions vulnerability

Browse Source 
(submitted patch slightly modified)

PR:     85920
Submitted by:   Marcus Alves Grando <marcus@corp.grupos.com.br>
This commit is contained in:
Andrey A. Chernov 2005-09-09 18:33:17 +00:00
parent 975f5a1beb
commit c0f88731fd
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=142310
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
archivers/unzip/Makefile
View File

@ -7,7 +7,7 @@
PORTNAME= unzip
PORTVERSION= 5.52
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES?= archivers
MASTER_SITES= ftp://ftp.info-zip.org/pub/infozip/src/ \
${MASTER_SITE_TEX_CTAN:S,%SUBDIR%,tools/zip/info-zip/src/,}

36
archivers/unzip/files/patch-unix_unix.c Normal file
View File

@ -0,0 +1,36 @@
--- unix/unix.c.orig Sat Feb 26 16:43:42 2005
+++ unix/unix.c Fri Sep 9 14:36:35 2005
@@ -1042,6 +1042,16 @@
ush z_uidgid[2];
int have_uidgid_flg;
+/*---------------------------------------------------------------------------
+ Change the file permissions from default ones to those stored in the
+ zipfile.
+ ---------------------------------------------------------------------------*/
+
+#ifndef NO_CHMOD
+ if (fchmod(fileno(G.outfile), filtattr(__G__ G.pInfo->file_attr)))
+ perror("fchmod (file attributes) error");
+#endif
+
fclose(G.outfile);
/*---------------------------------------------------------------------------
@@ -1150,16 +1160,6 @@
" (warning) cannot set times"));
#endif /* ?AOS_VS */
}
-
-/*---------------------------------------------------------------------------
- Change the file permissions from default ones to those stored in the
- zipfile.
- ---------------------------------------------------------------------------*/
-
-#ifndef NO_CHMOD
- if (chmod(G.filename, filtattr(__G__ G.pInfo->file_attr)))
- perror("chmod (file attributes) error");
-#endif
} /* end function close_outfile() */