clearlinux/swupd-client
2
0
Fork 0
mirror of https://github.com/clearlinux/swupd-client.git synced 2026-10-04 07:48:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

verifytime: Fix TOCTOU problem

Browse Source 
We can't assume that the file wasn't deleted between the execution of a
stat and a fopen. Printing error only when fopen fails.

Signed-off-by: Otavio Pontes <otavio.pontes@intel.com>
This commit is contained in:
Otavio Pontes
2018-11-13 13:22:09 -08:00
parent e121a6fc19
commit b72c01bbbe
1 changed files with 6 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/verifytime.c
+6 -7
View File
@@ -31,20 +31,19 @@
static unsigned long int get_versionstamp(void)
{
struct stat statt;
FILE *fp = NULL;
char data[11];
const char *filename = "/usr/share/clear/versionstamp";
unsigned long int version_num;
if (stat(filename, &statt) == -1) {
fprintf(stderr, "%s does not exist!\n", filename);
return 0;
}
errno = 0;
fp = fopen(filename, "r");
if (fp == NULL) {
fprintf(stderr, "Failed to open %s\n", filename);
if (errno == ENOENT) {
fprintf(stderr, "%s does not exist!\n", filename);
} else {
fprintf(stderr, "Failed to open %s\n", filename);
}
return 0;
}