(/home/sate/Testcases/c/cve/wireshark-1.2.0/gtk/follow_stream.c) |
| |
| 583 | | | follow_save_as_ok_cb(GtkWidget * w _U_, gpointer fs) |
| 584 | | | { |
| 585 | | | gchar *to_name; |
| 586 | | | follow_info_t *follow_info; |
| 587 | | | FILE *fh; |
| 588 | | | print_stream_t *stream = NULL; |
| 589 | | | gchar *dirname; |
| 590 | | | |
| 591 | | | to_name = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(fs));
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
34 | #define GTK_FILE_CHOOSER(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_FILE_CHOOSER, GtkFileChooser)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
33 | #define GTK_TYPE_FILE_CHOOSER (gtk_file_chooser_get_type ()) |
| |
|
| 592 | | | |
| 593 | | | |
| 594 | | | |
| 595 | [+] | | if (test_for_directory(to_name) == EISDIR) {
x /usr/include/asm-generic/errno-base.h |
| |
24 | #define EISDIR 21 /* Is a directory */ |
| |
|
Event 5:
to_name, which evaluates to gtk_file_chooser_get_filename(...) from follow_stream.c:591, is passed to test_for_directory(). See related event 4.
hide
|
|
 |
| 596 | | | |
| 597 | | | |
| 598 | | | set_last_open_dir(to_name); |
| 599 | | | g_free(to_name); |
| 600 | | | file_selection_set_current_folder(fs, get_last_open_dir()); |
| 601 | | | gtk_file_chooser_set_current_name(fs, ""); |
| 602 | | | return FALSE; |
| 603 | | | } |
| 604 | | | |
| 605 | | | follow_info = g_object_get_data(G_OBJECT(fs), E_FOLLOW_INFO_KEY);
x /usr/include/glib-2.0/gobject/gobject.h |
| |
52 | #define G_OBJECT(object) (G_TYPE_CHECK_INSTANCE_CAST ((object), G_TYPE_OBJECT, GObject)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
181 | #define G_TYPE_OBJECT G_TYPE_MAKE_FUNDAMENTAL (20) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
222 | #define G_TYPE_MAKE_FUNDAMENTAL(x) ((GType) ((x) << G_TYPE_FUNDAMENTAL_SHIFT)) |
| |
|
| 606 | | | |
| 607 | | | if (follow_info->show_type == SHOW_RAW) { |
Event 13:
Taking false branch. follow_info->show_type == SHOW_RAW evaluates to false.
hide
|
|
| 608 | | | |
| 609 | | | fh = ws_fopen(to_name, "wb"); |
| 610 | | | } else { |
| 611 | | | |
| 612 | | | fh = ws_fopen(to_name, "w"); |
Event 14:
to_name, which evaluates to gtk_file_chooser_get_filename(...) from follow_stream.c:591, is passed to fopen() as the first argument. See related events 4 and 7.
hide
File System Race Condition
The file named to_name is accessed again. Another process may have changed the file since the access at filesystem.c:215. For example, an attacker could replace the original file with a link to a file containing important or confidential data. The issue can occur if the highlighted code executes. See related events 8 and 14. Show: All events | Only primary events |
|
| |