[Qemu-devel] [PATCH] block: prevent snapshot mode $TMPDIR symlink attack

2012-05-28 Thread Jim Meyering
In snapshot mode, bdrv_open creates an empty temporary file without checking for mkstemp or close failure, and ignoring the possibility of a buffer overrun given a surprisingly long $TMPDIR. Change the get_tmp_filename function to return int (not void), so that it can inform its two callers of

Re: [Qemu-devel] [PATCH] block: prevent snapshot mode $TMPDIR symlink attack

2012-05-28 Thread Stefan Hajnoczi
On Mon, May 28, 2012 at 8:27 AM, Jim Meyering j...@meyering.net wrote: diff --git a/block/vvfat.c b/block/vvfat.c index 2dc9d50..0fd3367 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -2808,7 +2808,12 @@ static int enable_write_target(BDRVVVFATState *s)     array_init((s-commits),