(/home/sate/Testcases/c/cve/dovecot-1.2.0/src/plugins/lazy-expunge/lazy-expunge-plugin.c) |
| |
| 309 | | | static int dir_move_or_merge(struct mailbox_list *list, |
| 310 | | | const char *srcdir, const char *destdir) |
| 311 | | | { |
| 312 | | | DIR *dir; |
| 313 | | | struct dirent *dp; |
| 314 | | | string_t *src_path, *dest_path; |
| 315 | | | unsigned int src_dirlen, dest_dirlen; |
| 316 | | | int ret = 0; |
| 317 | | | |
| 318 | | | if (rename(srcdir, destdir) == 0 || errno == ENOENT)
x /usr/include/asm-generic/errno-base.h |
| |
5 | #define ENOENT 2 /* No such file or directory */ |
| |
|
Event 1:
srcdir is passed to rename() as the first argument.
hide
Event 2:
rename() accesses the file named srcdir. - The same name is used to access a file later, but it is not safe to assume that it will be the same underlying file.
See related event 1.
hide
Event 3:
Skipping " if". - rename(srcdir, destdir) == 0 evaluates to false.
- errno == 2 evaluates to false.
hide
|
|
| 319 | | | return 0; |
| 320 | | | |
| 321 | | | if (!EDESTDIREXISTS(errno)) {
x /home/sate/Testcases/c/cve/dovecot-1.2.0/src/lib/compat.h |
| |
253 | #define EDESTDIREXISTS(errno) \ |
254 | ((errno) == EEXIST || (errno) == ENOTEMPTY || (errno) == EBUSY) |
| |
x /usr/include/asm-generic/errno.h |
| |
10 | #define ENOTEMPTY 39 /* Directory not empty */ |
| |
x /usr/include/asm-generic/errno-base.h |
| |
19 | #define EBUSY 16 /* Device or resource busy */ |
| |
|
Event 4:
Skipping " if". errno == 17 evaluates to true.
hide
|
|
| 322 | | | mailbox_list_set_critical(list, |
| 323 | | | "rename(%s, %s) failed: %m", srcdir, destdir); |
| 324 | | | } |
| 325 | | | |
| 326 | | | |
| 327 | | | dir = opendir(srcdir); |
Event 5:
srcdir is passed to opendir().
hide
File System Race Condition
The file named srcdir is accessed again. Another process may have changed the file since the access at lazy-expunge-plugin.c:318. For example, an attacker could replace the original file with a link to a file containing important or confidential data. The issue can occur if the highlighted code executes. See related events 2 and 5. Show: All events | Only primary events |
|
| |