From 90ad42d814db1de83a7432ea62d008d70430d724 Mon Sep 17 00:00:00 2001 From: Alexander Egorenkov Date: Thu, 2 Jul 2026 11:50:07 +0200 Subject: [PATCH] zdump/zg: Use fstat() to obtain file information in zg_open() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use the file descriptor opened in zg_open() before to obtain information about the file. Theoretically, there is a tiny window for a race condition between opening a file and obtaining its information with stat(). A malicious user could use it to entice incorrect behavior from zgetdump. Using the same file descriptor for both operations prevents such situations. Suggested-by: Peter Jin Signed-off-by: Alexander Egorenkov Reviewed-by: Marc Hartmayer Reviewed-by: Mikhail Zaslonko Signed-off-by: Jan Höppner --- zdump/zg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zdump/zg.c b/zdump/zg.c index 026b1057..0a9fdf53 100644 --- a/zdump/zg.c +++ b/zdump/zg.c @@ -156,7 +156,7 @@ struct zg_fh *zg_open(const char *path, int flags, enum zg_check check) goto fail; ERR_EXIT_ERRNO("Could not open \"%s\"", path); } - if (stat(path, &zg_fh->sb) == -1) { + if (fstat(zg_fh->fh, &zg_fh->sb) == -1) { if (check == ZG_CHECK_NONE) goto fail; ERR_EXIT_ERRNO("Could not access file \"%s\"", path);