fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-29 18:30:08 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix CVE-2011-4028: File disclosure vulnerability.

Browse source 
use O_NOFOLLOW to open the existing lock file, so symbolic links
aren't followed, thus avoid revealing if it point to an existing
file.

Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 6ba44b91e3)
This commit is contained in:
Matthieu Herrb 2011-10-17 22:26:12 +02:00 • committed by Julien Cristau
parent 99520ddbb1
commit 1fec281b0d
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
os/utils.c
View file

@ -327,7 +327,7 @@ LockServer(void)
/*
* Read the pid from the existing file
*/
lfd = open(LockFile, O_RDONLY);
lfd = open(LockFile, O_RDONLY|O_NOFOLLOW);
if (lfd < 0) {
unlink(tmp);
FatalError("Can't read lock file %s\n", LockFile);