[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] net: fix insecure temporary file creation in SL
|
From: |
Markus Armbruster |
|
Subject: |
Re: [Qemu-devel] [PATCH] net: fix insecure temporary file creation in SLiRP |
|
Date: |
Wed, 03 Jun 2015 13:03:33 +0200 |
|
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) |
P J P <address@hidden> writes:
> Hello Markus,
>
>> On Monday, 1 June 2015 1:28 PM, Markus Armbruster <address@hidden> wrote:
>> Michael (cc'ed) already posted "[PATCH] slirp: use less predictable
>> directory name in /tmp for smb config (CVE-2015-4037)"[*]. His patch
>> clobbers s->smb_dir[] when mkdtemp() fails (missed that in my review),
>> yours doesn't.
>>
>> Suggest you guys figure out together which solution you want.
>
>
> Thank you so much for the review. IMO using separate smb_dir[] is
> prudent than s->smb_dir.
Let's go with Michael's v2, because it also fixes the "cleanup after
mkdir() / mkdtemp() failed" scenario.
[...]