0ce2cf9d2d
"Vulnerabilities in Berkeley MPEG Tools can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges. The vulnerabilities are caused due to temporary files being created insecurely in "/tmp." http://secunia.com/advisories/17008/ http://www.gentoo.org/security/en/glsa/glsa-200510-02.xml Patches from Gentoo.
49 lines
1.2 KiB
Text
49 lines
1.2 KiB
Text
$NetBSD: patch-an,v 1.1 2005/10/05 11:45:46 salo Exp $
|
|
|
|
Fix for SA17008, from Gentoo.
|
|
|
|
--- readframe.c.orig 1995-08-15 00:31:58.000000000 +0200
|
|
+++ readframe.c 2005-10-05 13:25:40.000000000 +0200
|
|
@@ -227,14 +227,22 @@
|
|
* SIDE EFFECTS: none
|
|
*
|
|
*===========================================================================*/
|
|
+void _ReadFrame(MpegFrame *frame, char *fileName, FILE *fileHook, char *conversion, boolean addPath);
|
|
+
|
|
+void ReadFrame(MpegFrame *frame, char *fileName, char *conversion, boolean addPath)
|
|
+{
|
|
+ _ReadFrame(frame, fileName, NULL, conversion, addPath);
|
|
+}
|
|
+
|
|
void
|
|
-ReadFrame(frame, fileName, conversion, addPath)
|
|
+_ReadFrame(frame, fileName, fileHook, conversion, addPath)
|
|
MpegFrame *frame;
|
|
char *fileName;
|
|
+ FILE *fileHook;
|
|
char *conversion;
|
|
boolean addPath;
|
|
{
|
|
- FILE *ifp;
|
|
+ FILE *ifp = fileHook;
|
|
char command[1024];
|
|
char fullFileName[1024];
|
|
MpegFrame tempFrame;
|
|
@@ -274,6 +282,9 @@
|
|
}
|
|
#endif
|
|
|
|
+ if (fileHook)
|
|
+ goto file_is_already_opened;
|
|
+
|
|
if ( fileType == ANY_FILE_TYPE ) {
|
|
char *convertPtr, *commandPtr, *charPtr;
|
|
|
|
@@ -325,6 +336,7 @@
|
|
exit(1);
|
|
}
|
|
|
|
+file_is_already_opened:
|
|
switch(baseFormat) {
|
|
case YUV_FILE_TYPE:
|
|
|