From: dank@kegel.com
To: linux-kernel@vger.kernel.org
Subject: [CHECKER] Fix "null-deref" error in khttpd
Date: Tue, 13 Aug 2002 09:14:13 -0700 [thread overview]
Message-ID: <200208131614.g7DGEDH03569@kegel.com> (raw)
I have not tested this, but it's "obviously correct", and it
should fix a minor error reported by the Stanford checker in khttpd;
see http://marc.theaimsgroup.com/?l=linux-kernel&m=99601418013486
It was posted to the khttpd mailing list a week or so ago.
Comments welcome.
- Dan
--- linux-2.4.19-pre9/net/khttpd/security.c.orig Tue Aug 6 16:13:21 2002
+++ linux/net/khttpd/security.c Tue Aug 6 16:33:08 2002
@@ -83,22 +83,21 @@
*/
struct file *OpenFileForSecurity(char *Filename)
{
- struct file *filp;
+ struct file *filp = NULL;
struct DynamicString *List;
umode_t permission;
-
-
EnterFunction("OpenFileForSecurity");
if (Filename==NULL)
- return NULL;
+ goto out_error;
- if (strlen(Filename)>=256 ) return NULL; /* Sanity check */
+ if (strlen(Filename)>=256 )
+ goto out_error; /* Sanity check */
/* Rule no. 1 -- No "?" characters */
#ifndef BENCHMARK
if (strchr(Filename,'?')!=NULL)
- return NULL;
+ goto out_error;
/* Intermediate step: decode all %hex sequences */
@@ -106,9 +105,8 @@
/* Rule no. 2 -- Must start with a "/" */
-
if (Filename[0]!='/')
- return NULL;
+ goto out_error;
#endif
/* Rule no. 3 -- Does the file exist ? */
@@ -116,55 +114,44 @@
filp = filp_open(Filename, O_RDONLY, 0);
if (IS_ERR(filp))
- return NULL;
+ goto out_error;
#ifndef BENCHMARK
permission = filp->f_dentry->d_inode->i_mode;
/* Rule no. 4 : must have enough permissions */
-
if ((permission & sysctl_khttpd_permreq)==0)
- {
- if (filp!=NULL)
- fput(filp);
- filp=NULL;
- return NULL;
- }
-
+ goto out_error_put;
+
/* Rule no. 5 : cannot have "forbidden" permission */
-
if ((permission & sysctl_khttpd_permforbid)!=0)
- {
- if (filp!=NULL)
- fput(filp);
- filp=NULL;
- return NULL;
- }
+ goto out_error_put;
/* Rule no. 6 : No string in DynamicList can be a
substring of the filename */
-
List = DynamicList;
-
while (List!=NULL)
{
if (strstr(Filename,List->value)!=NULL)
- {
- if (filp!=NULL)
- fput(filp);
- filp=NULL;
- return NULL;
- }
+ goto out_error_put;
+
List = List->Next;
}
#endif
LeaveFunction("OpenFileForSecurity - success");
-
+out:
return filp;
+
+out_error_put:
+ fput(filp);
+out_error:
+ filp=NULL;
+ LeaveFunction("OpenFileForSecurity - fail");
+ goto out;
}
/*
reply other threads:[~2002-08-13 16:05 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200208131614.g7DGEDH03569@kegel.com \
--to=dank@kegel.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®