(/home/sate/Testcases/c/cve/wireshark-1.2.0/gtk/graph_analysis.c) |
| |
| 514 | | | static gboolean save_to_file_ok_cb(GtkWidget *ok_bt _U_, gpointer user_data) |
| 515 | | | { |
| 516 | | | FILE *file_test; |
| 517 | | | graph_analysis_data_t *user_data_p; |
| 518 | | | |
| 519 | | | user_data_p = user_data; |
Event 1:
user_data_p is set to user_data.
hide
|
|
| 520 | | | |
| 521 | | | user_data_p->dlg.save_file = gtk_file_chooser_get_filename(GTK_FILE_CHOOSER(save_to_file_w));
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
34 | #define GTK_FILE_CHOOSER(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_FILE_CHOOSER, GtkFileChooser)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
33 | #define GTK_TYPE_FILE_CHOOSER (gtk_file_chooser_get_type ()) |
| |
|
| 522 | | | |
| 523 | | | |
| 524 | | | |
| 525 | [+] | | if (test_for_directory(user_data_p->dlg.save_file) == EISDIR) {
x /usr/include/asm-generic/errno-base.h |
| |
24 | #define EISDIR 21 /* Is a directory */ |
| |
|
Event 6:
user_data_p->dlg.save_file, which evaluates to gtk_file_chooser_get_filename(...) from graph_analysis.c:521, is passed to test_for_directory(). See related events 1 and 5.
hide
|
|
 |
| 526 | | | |
| 527 | | | set_last_open_dir(user_data_p->dlg.save_file); |
| 528 | | | file_selection_set_current_folder(save_to_file_w, get_last_open_dir()); |
| 529 | | | gtk_file_chooser_set_current_name(GTK_FILE_CHOOSER(save_to_file_w), "");
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
34 | #define GTK_FILE_CHOOSER(obj) (G_TYPE_CHECK_INSTANCE_CAST ((obj), GTK_TYPE_FILE_CHOOSER, GtkFileChooser)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
482 | #define G_TYPE_CHECK_INSTANCE_CAST(instance, g_type, c_type) (_G_TYPE_CIC ((instance), (g_type), c_type)) |
| |
x /usr/include/glib-2.0/gobject/gtype.h |
| |
1678 | # define _G_TYPE_CIC(ip, gt, ct) \ |
1679 | ((ct*) g_type_check_instance_cast ((GTypeInstance*) ip, gt)) |
| |
x /usr/include/gtk-2.0/gtk/gtkfilechooser.h |
| |
33 | #define GTK_TYPE_FILE_CHOOSER (gtk_file_chooser_get_type ()) |
| |
|
| 530 | | | g_free(user_data_p->dlg.save_file); |
| 531 | | | return FALSE; |
| 532 | | | } |
| 533 | | | |
| 534 | | | |
| 535 | | | |
| 536 | | | |
| 537 | | | |
| 538 | | | |
| 539 | | | |
| 540 | | | |
| 541 | | | |
| 542 | | | |
| 543 | | | file_test = ws_fopen(user_data_p->dlg.save_file,"r"); |
Event 12:
user_data_p->dlg.save_file, which evaluates to gtk_file_chooser_get_filename(...) from graph_analysis.c:521, is passed to fopen() as the first argument. See related events 1, 5, and 8.
hide
File System Race Condition
The file named user_data_p->dlg.save_file is accessed again. Another process may have changed the file since the access at filesystem.c:215. For example, an attacker could replace the original file with a link to a file containing important or confidential data. - user_data_p->dlg.save_file evaluates to gtk_file_chooser_get_filename(...) from graph_analysis.c:521.
The issue can occur if the highlighted code executes. See related events 9 and 12. Show: All events | Only primary events |
|
| |