-
Notifications
You must be signed in to change notification settings - Fork 292
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix for stat(2) path traversal using fstat #138
Conversation
return(3); | ||
} | ||
#endif | ||
if (st(fd, &info)) { | ||
lua_pushnil(L); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think you should also close file inside if statement
@jaromil Feel free to simplify the internals if it aids with the bugfix and preserves portability! |
Thanks for your feedbacks, knowing your interest now I'll rework the PR into something more presentable and passing tests. |
9cd10fe
to
f77f248
Compare
@jaromil Your fix doesn't solve anything. In fact, it makes the code a lot worse in maintainability, readability and in functionality. Let me explain. From reading your proposal and reviewing your changes I see that you try to convince us to use
The three functions To illustrate the limitation I have the following example. Suppose I want to get the file information from a file with the path Your changes in this PR can be simplified to the following code.
With the simplification, I created a new function called In summary. Looking from a logical perspective, using |
Thanks for triaging, weirdly enough the fstat approach worked in my (long forgotten) use case, can't figure out why now, must have been a kernel or filesystem issue because what you say is right in theory. Ciao |
Hi there!
Here is my fix to retrieve correct file information on POSX systems when along the path traversal a directory has no executable flag.
From
stat(2)
manpage:At the moment this is an incomplete fix: it breaks usage of
lstat(2)
on POSIX systems, due to change of the function signature passed to_file_info_()
.Kindly provide feedback on how to proceed. IMHO the usage of a function pointer passed as argument of file_info is a design burden: a simple flag can be used.
ciao
p.s. for the impatient, a quick non-breaking fix is applied in the lfs version shipped in my software.