зеркало из https://github.com/microsoft/clang-1.git
Check that the directory does not exist.
Otherwise, it could allows local users to obtain sensitive information or overwrite arbitrary files via a symlink attack on temporary directories with predictable names. Reported as CVE-2014-2893 ( https://security-tracker.debian.org/tracker/CVE-2014-2893 ) Found by Jakub Wilk git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@211051 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Родитель
e4d7f02c06
Коммит
4a2040bc0e
|
@ -206,6 +206,12 @@ sub GetHTMLRunDir {
|
|||
else {
|
||||
$NewDir = "$Dir/$DateString-$RunNumber";
|
||||
}
|
||||
|
||||
# Make sure that the directory does not exist in order to avoid hijack.
|
||||
if (-d $NewDir) {
|
||||
DieDiag("The directory '$NewDir' already exists.\n");
|
||||
}
|
||||
|
||||
mkpath($NewDir);
|
||||
return $NewDir;
|
||||
}
|
||||
|
|
Загрузка…
Ссылка в новой задаче