From b72c01bbbebed0c599faf7bc22c85ddc3dc0ba1d Mon Sep 17 00:00:00 2001 From: Otavio Pontes Date: Tue, 13 Nov 2018 19:01:16 +0000 Subject: [PATCH] verifytime: Fix TOCTOU problem We can't assume that the file wasn't deleted between the execution of a stat and a fopen. Printing error only when fopen fails. Signed-off-by: Otavio Pontes --- src/verifytime.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/src/verifytime.c b/src/verifytime.c index c418163f..35133fca 100644 --- a/src/verifytime.c +++ b/src/verifytime.c @@ -31,20 +31,19 @@ static unsigned long int get_versionstamp(void) { - struct stat statt; FILE *fp = NULL; char data[11]; const char *filename = "/usr/share/clear/versionstamp"; unsigned long int version_num; - if (stat(filename, &statt) == -1) { - fprintf(stderr, "%s does not exist!\n", filename); - return 0; - } - + errno = 0; fp = fopen(filename, "r"); if (fp == NULL) { - fprintf(stderr, "Failed to open %s\n", filename); + if (errno == ENOENT) { + fprintf(stderr, "%s does not exist!\n", filename); + } else { + fprintf(stderr, "Failed to open %s\n", filename); + } return 0; }