On 04/02/2013 04:44 PM, Denys Vlasenko wrote:
Signed-off-by: Denys Vlasenko <dvlasenk(a)redhat.com>
---
src/plugins/reporter-rhtsupport.c | 27 ++++++++++++++++++++++++++-
1 file changed, 26 insertions(+), 1 deletion(-)
diff --git a/src/plugins/reporter-rhtsupport.c b/src/plugins/reporter-rhtsupport.c
index 2eb41b4..406488f 100644
--- a/src/plugins/reporter-rhtsupport.c
+++ b/src/plugins/reporter-rhtsupport.c
@@ -36,6 +36,31 @@ static report_result_t *get_reported_to(const char *dump_dir_name)
}
static
+char *make_temp_file_name(const char *tmpdir_name, const char *dump_dir_name)
+{
+ char *abspath = realpath(dump_dir_name, NULL);
+ char *base = strrchr((abspath ? abspath : dump_dir_name), '/');
+
+ /* If realpath failed and dump_dir_name is malicious (say, "/foo/.."),
+ * we may end up tricked into doing some bad things. Don't allow that.
+ */
+ char buf[sizeof("tmp-"LIBREPORT_ISO_DATE_STRING_SAMPLE"-%lu")];
+ if (base && base[1] && base[1] != '.')
+ {
+ /* We have a slash and it's not "foo/" or
"foo/.<something>" */
+ base++;
+ }
+ else
+ {
+ sprintf(buf, "tmp-%s-%lu", iso_date_string(NULL), (long)getpid());
+ base = buf;
+ }
- it would be much better if the logic to get the basename would be in
the dump_dir api, so we don't end up with implementing this again on
different places
+ char *name = xasprintf("%s/%s.tar.gz", tmpdir_name,
base);
+ free(abspath);
+ return name;
+}
+
+static
int create_tarball(const char *tempfile, problem_data_t *problem_data)
{
reportfile_t *file = NULL;
@@ -375,7 +400,7 @@ int main(int argc, char **argv)
/* Starting from here, we must perform cleanup on errors
* (delete temp dir)
*/
- tempfile = xasprintf("%s/tmp-%s-%lu.tar.gz", tmpdir_name,
iso_date_string(NULL), (long)getpid());
+ tempfile = make_temp_file_name(tmpdir_name, dump_dir_name);
if (create_tarball(tempfile, problem_data) != 0)
{
errmsg = _("Can't create temporary file in /tmp");