ports/textproc/scrollkeeper/files/patch-cl_src_get-cl.c
Joe Marcus Clarke 572d0b6afc Attempt to fix a security bug in scrollkeeper in which the code will follow
symlinks when attempting to locate a temp file.  Note, this is not the
author's patch, but one of my own.  I think this should fix it, but I'm
not sure if I'm missing something.  The patch is based on the description
from securityfocus.com.

See http://online.securityfocus.com/bid/5602/info/ for more details.

Reported by:	Daniel Harris <dh@askdh.com>
2002-09-13 04:03:50 +00:00

11 lines
350 B
C

--- cl/src/get-cl.c.orig Thu Sep 12 23:54:01 2002
+++ cl/src/get-cl.c Thu Sep 12 23:54:44 2002
@@ -44,7 +44,7 @@
for(i = 0; i < 5; i++) {
snprintf(path, PATHLEN, "/tmp/scrollkeeper-tempfile.%d", i);
- if (stat(path, &buf) == -1) {
+ if (lstat(path, &buf) == -1) {
if (errno == ENOENT) {
/* this is an empty slot so use it */