Date: Fri, 29 May 2009 18:53:22 +0200 From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no> To: Bruce Evans <bde@zeta.org.au> Cc: freebsd-hackers@FreeBSD.org, Jakub Lach <jakub_lach@mailplus.pl> Subject: Re: FYI Lighttpd 1.4.23 /kernel (trailing '/' on regular file symlink) vulnerability Message-ID: <86vdnju9z1.fsf@ds4.des.no> In-Reply-To: <20090529210855.V1643@besplex.bde.org> (Bruce Evans's message of "Sat, 30 May 2009 02:01:47 %2B1000 (EST)") References: <23727599.post@talk.nabble.com> <86prdvipwe.fsf@ds4.des.no> <20090527233110.E4243@delplex.bde.org> <86r5yaijef.fsf@ds4.des.no> <20090529210855.V1643@besplex.bde.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Bruce Evans <bde@zeta.org.au> writes: > Dag-Erling Sm=C3=B8rgrav <des@des.no> writes: > % Index: sys/kern/vfs_lookup.c > % =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > % --- sys/kern/vfs_lookup.c (revision 192899) > % +++ sys/kern/vfs_lookup.c (working copy) > % @@ -147,6 +147,9 @@ > % cnp->cn_flags &=3D ~LOCKSHARED; > % fdp =3D p->p_fd; > % % + /* We will set this ourselves if we need it. */ > % + cnp->cn_flags &=3D ~TRAILINGSLASH; > % + > > Can TRAILINGSLASH ever be set here? Is namei() ever called recursively? "suspenders and a belt" It is hypothetically possible for the caller to have set it. > % /* > % * Get a buffer for the name to be translated, and copy the > % * name into the buffer. > % @@ -533,6 +536,8 @@ > % if (*cp =3D=3D '\0') { > % trailing_slash =3D 1; > > I thought at first that this flag can go away. I intend to remove it later - I just wanted to get the bug fixed first. I'm happy to hear that removing it will fix the two bugs introduced by the patch I committed :) DES --=20 Dag-Erling Sm=C3=B8rgrav - des@des.no
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?86vdnju9z1.fsf>