lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-29 11:41:21 +03:00
Code Activity

Restrict shm_open and shm_unlink to SHMDIR. Fixes bugs 14752 and 15763.

Browse Source
This commit is contained in:
Ondřej Bílka
2013-10-31 13:58:01 +01:00
parent 8a43e768d9
commit 5d30d85329
4 changed files with 31 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
sysdeps/unix/sysv/linux/shm_open.c
View File

@ -148,14 +148,15 @@ shm_open (const char *name, int oflag, mode_t mode)
while (name[0] == '/')
++name;
if (name[0] == '\0')
namelen = strlen (name);
/* Validate the filename. */
if (name[0] == '\0' || namelen > NAME_MAX || strchr (name, '/') == NULL)
{
/* The name "/" is not supported. */
__set_errno (EINVAL);
return -1;
}
namelen = strlen (name);
fname = (char *) alloca (mountpoint.dirlen + namelen + 1);
__mempcpy (__mempcpy (fname, mountpoint.dir, mountpoint.dirlen),
name, namelen + 1);
@ -237,14 +238,15 @@ shm_unlink (const char *name)
while (name[0] == '/')
++name;
if (name[0] == '\0')
namelen = strlen (name);
/* Validate the filename. */
if (name[0] == '\0' || namelen > NAME_MAX || strchr (name, '/') == NULL)
{
/* The name "/" is not supported. */
__set_errno (ENOENT);
return -1;
}
namelen = strlen (name);
fname = (char *) alloca (mountpoint.dirlen + namelen + 1);
__mempcpy (__mempcpy (fname, mountpoint.dir, mountpoint.dirlen),
name, namelen + 1);