Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 12 Nov 2020 20:32:07 +0100
From: Markus Wichmann <nullplan@....net>
To: musl@...ts.openwall.com
Subject: Re: [PATCH] fix segfault in lutimes when tv argument is NULL

On Thu, Nov 12, 2020 at 03:43:27PM -0300, √Črico Nogueira wrote:
> From: √Črico Rolim <ericonr@...root.org>
>
> calling lutimes with tv=0 is valid if the applications wants to set the
> timestamps to the current time. short-circuit the function to call
> utimensat with times=0 directly if tv == 0.
> ---
>
> Bug reported on IRC by nmeum
>
>  src/legacy/lutimes.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/src/legacy/lutimes.c b/src/legacy/lutimes.c
> index 2e5502d1..22176230 100644
> --- a/src/legacy/lutimes.c
> +++ b/src/legacy/lutimes.c
> @@ -5,6 +5,7 @@
>
>  int lutimes(const char *filename, const struct timeval tv[2])
>  {
> +	if (!tv) return utimensat(AT_FDCWD, filename, 0, AT_SYMLINK_NOFOLLOW);
>  	struct timespec times[2];
>  	times[0].tv_sec  = tv[0].tv_sec;
>  	times[0].tv_nsec = tv[0].tv_usec * 1000;
> --
> 2.29.2
>

Deja vu. We had a similar discussion in early March. The most recent
e-mail in that thread stated that the patch "might be correct as-is."
Though that patch did attempt to filter out invalid inputs as well. I
had pointed out that the only spec available for lutimes does state that
it should act like utimes(), and utimes() does allow for NULL inputs,
but there was no reply. And no follow-up from the OP, either.

Ciao,
Markus

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.