Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix for stat(2) path traversal using fstat #138

Closed
wants to merge 1 commit into from
Closed

fix for stat(2) path traversal using fstat #138

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 23 additions & 2 deletions src/lfs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,7 @@ typedef struct dir_data {
#define _O_BINARY 0
#define lfs_setmode(file, m) ((void)file, (void)m, 0)
#define STAT_STRUCT struct stat
#define STAT_FUNC stat
#define STAT_FUNC fstat
#define LSTAT_FUNC lstat

#endif
Expand Down Expand Up @@ -1014,13 +1014,34 @@ static int _file_info_(lua_State * L,
const char *file = luaL_checkstring(L, 1);
int i;

if (st(file, &info)) {
#ifndef _WIN32
// From stat(2) manpage: "No permissions are required on the file
// itself, but—in the case of stat(), fstatat(), and lstat() execute
// (search) permission is required on all of the directories in
// pathname that lead to the file."
//
// Therefore here fstat is used on a previously open file descriptor
// to avoid unneeded limitations on POSIX systems.
int fd = open(file, O_RDONLY);
if(fd<0) {
lua_pushnil(L);
lua_pushfstring(L, "cannot open file '%s': %s",
file, strerror(errno));
lua_pushinteger(L, errno);
return(3);
}
#endif
if (st(fd, &info)) {
lua_pushnil(L);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you should also close file inside if statement

lua_pushfstring(L, "cannot obtain information from file '%s': %s",
file, strerror(errno));
lua_pushinteger(L, errno);
return 3;
}
#ifndef _WIN32
close(fd);
#endif

if (lua_isstring(L, 2)) {
const char *member = lua_tostring(L, 2);
for (i = 0; members[i].name; i++) {
Expand Down