Bug#612035: Ping: Bug#612035: [Pkg-phototools-devel] Bug#612035: vulnerability: rewrite arbitrary user file

[Daniel Friesel]

Hi,

On Thu, Jan 19, 2012 at 12:47:06PM +0000, Jonathan Wiltshire wrote:
> On Fri, Jul 08, 2011 at 08:06:17PM +0200, Julien Cristau wrote:
> > [...]
> > ick.  mkdtemp(3), please.
> Any news on this?

the attached patches (created against the unpatched 1.3.4.dfsg.1-1 / 1.8-1
packages) use mkdtemp for the fix.

I removed the --cache 0 wget argument because my system's wget does not support
it anymore, if the wget in oldstable still has it it's safe to put that back in.

--Daniel

diff --git a/src/imlib.c b/src/imlib.c
index fc4dcf0..1d06628 100644
--- a/src/imlib.c
+++ b/src/imlib.c
@@ -263,7 +263,7 @@ feh_http_load_image(char *url)
    char *newurl = NULL;
    char randnum[20];
    int rnum;
-   char *path = NULL;
+   static char *path = NULL;
 
    D_ENTER(4);
 
@@ -274,11 +274,16 @@ feh_http_load_image(char *url)
       else
          path = "";
    }
-   else
-      path = "/tmp/";
+   else {
+      path = estrdup("/tmp/feh_XXXXXX");
+	if (mkdtemp(path) == NULL)
+		eprintf("Failed to create temporary directory");
+	path = estrjoin("", path, "/", NULL);
+	opt.tmp_path = path;
+   }
 
    basename = strrchr(url, '/') + 1;
-   tmpname = feh_unique_filename(path, basename);
+   tmpname = estrjoin("", path, basename, NULL);
 
    if (opt.wget_timestamp)
    {
@@ -288,7 +293,7 @@ feh_http_load_image(char *url)
       ppid = getpid();
       snprintf(cppid, sizeof(cppid), "%06ld", (long)ppid);
       tmpname_timestamper =
-         estrjoin("", "/tmp/feh_", cppid, "_", basename, NULL);
+         estrjoin("", path, cppid, "_", basename, NULL);
    }
 
    if (opt.wget_timestamp)
@@ -548,7 +553,7 @@ feh_http_load_image(char *url)
          }
          else
          {
-            execlp("wget", "wget", "--cache", "0", newurl, "-O", tmpname,
+            execlp("wget", "wget", newurl, "-O", tmpname,
                    quiet, (char*) NULL);
          }
          eprintf("url: exec failed: wget:");
diff --git a/src/main.c b/src/main.c
index 745fdf9..4fbe600 100644
--- a/src/main.c
+++ b/src/main.c
@@ -215,5 +215,8 @@ feh_clean_exit(void)
    if (opt.filelistfile)
       feh_write_filelist(filelist, opt.filelistfile);
 
+	if (opt.tmp_path && !opt.keep_http)
+		rmdir(opt.tmp_path);
+
    D_RETURN_(4);
 }
diff --git a/src/options.c b/src/options.c
index d9d803d..7fd46b0 100644
--- a/src/options.c
+++ b/src/options.c
@@ -55,6 +55,7 @@ init_parse_options(int argc, char **argv)
    opt.thumb_h = 60;
    opt.menu_font = estrdup(DEFAULT_MENU_FONT);
    opt.font = estrdup(DEFAULT_FONT);
+   opt.tmp_path = NULL;
    opt.menu_bg = estrdup(PREFIX "/share/feh/images/menubg_default.png");
    opt.menu_style = estrdup(PREFIX "/share/feh/fonts/menu.style");
    opt.menu_border = 4;
diff --git a/src/options.h b/src/options.h
index 0101885..f365da8 100644
--- a/src/options.h
+++ b/src/options.h
@@ -89,6 +89,8 @@ struct __fehoptions
    char *menu_style;
    char *caption_path;
 
+   char *tmp_path;
+
    gib_style *menu_style_l;
 
    unsigned char next_button;

diff --git a/src/imlib.c b/src/imlib.c
index 69c6e50..ea88754 100644
--- a/src/imlib.c
+++ b/src/imlib.c
@@ -232,15 +232,20 @@ char *feh_http_load_image(char *url)
 {
 	char *tmpname;
 	char *basename;
-	char *path = NULL;
+	static char *path = NULL;
 
 	if (opt.keep_http) {
 		if (opt.output_dir)
 			path = opt.output_dir;
 		else
 			path = "";
-	} else
-		path = "/tmp/";
+	} else {
+		path = estrdup("/tmp/feh_XXXXXX");
+		if (mkdtemp(path) == NULL)
+			eprintf("Failed to create temporary directory:");
+		path = estrjoin(NULL, path, "/", NULL);
+		opt.tmp_path = path;
+	}
 
 	basename = strrchr(url, '/') + 1;
 	tmpname = feh_unique_filename(path, basename);
diff --git a/src/main.c b/src/main.c
index ce46879..9588863 100644
--- a/src/main.c
+++ b/src/main.c
@@ -190,5 +190,8 @@ void feh_clean_exit(void)
 	if (opt.filelistfile)
 		feh_write_filelist(filelist, opt.filelistfile);
 
+	if (opt.tmp_path && !opt.keep_http)
+		rmdir(opt.tmp_path);
+
 	return;
 }
diff --git a/src/options.c b/src/options.c
index 5962ca1..5f928ed 100644
--- a/src/options.c
+++ b/src/options.c
@@ -56,6 +56,7 @@ void init_parse_options(int argc, char **argv)
 	opt.thumb_redraw = 10;
 	opt.menu_font = estrdup(DEFAULT_MENU_FONT);
 	opt.font = NULL;
+	opt.tmp_path = NULL;
 	opt.image_bg = estrdup("default");
 	opt.menu_bg = estrdup(PREFIX "/share/feh/images/menubg_default.png");
 	opt.menu_style = estrdup(PREFIX "/share/feh/fonts/menu.style");
diff --git a/src/options.h b/src/options.h
index be20687..2cb174e 100644
--- a/src/options.h
+++ b/src/options.h
@@ -88,6 +88,8 @@ struct __fehoptions {
 	char *caption_path;
 	char *start_list_at;
 
+	char *tmp_path;
+
 	gib_style *menu_style_l;
 
 	unsigned char pan_button;

signature.asc
Description: Digital signature