kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zdump/zg: Use fstat() to obtain file information in zg_open()

Browse Source 
Use the file descriptor opened in zg_open() before to obtain information
about the file. Theoretically, there is a tiny window for a race
condition between opening a file and obtaining its information with
stat(). A malicious user could use it to entice incorrect behavior
from zgetdump. Using the same file descriptor for both operations
prevents such situations.

Suggested-by: Peter Jin <pjin@linux.ibm.com>
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Alexander Egorenkov
2026-07-02 11:50:07 +02:00
committed by Jan Höppner
parent cf7c74b2dc
commit 90ad42d814
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
zdump/zg.c
View File

@@ -156,7 +156,7 @@ struct zg_fh *zg_open(const char *path, int flags, enum zg_check check)
goto fail;
ERR_EXIT_ERRNO("Could not open \"%s\"", path);
}
if (stat(path, &zg_fh->sb) == -1) {
if (fstat(zg_fh->fh, &zg_fh->sb) == -1) {
if (check == ZG_CHECK_NONE)
goto fail;
ERR_EXIT_ERRNO("Could not access file \"%s\"", path);