Check that the directory does not exist.

Otherwise, it could allows local users to obtain sensitive information or
overwrite arbitrary files via a symlink attack on temporary directories with
predictable names. 

Reported as CVE-2014-2893 ( https://security-tracker.debian.org/tracker/CVE-2014-2893 )
Found by Jakub Wilk



git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@211051 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Sylvestre Ledru 2014-06-16 20:31:15 +00:00
Родитель e4d7f02c06
Коммит 4a2040bc0e
1 изменённых файлов: 6 добавлений и 0 удалений

Просмотреть файл

@ -206,6 +206,12 @@ sub GetHTMLRunDir {
else {
$NewDir = "$Dir/$DateString-$RunNumber";
}
# Make sure that the directory does not exist in order to avoid hijack.
if (-d $NewDir) {
DieDiag("The directory '$NewDir' already exists.\n");
}
mkpath($NewDir);
return $NewDir;
}