diff options
| -rw-r--r-- | recipes/pulseaudio/files/CVE-2009-1299.patch | 86 | ||||
| -rw-r--r-- | recipes/pulseaudio/pulseaudio_0.9.15.bb | 3 |
2 files changed, 88 insertions, 1 deletions
diff --git a/recipes/pulseaudio/files/CVE-2009-1299.patch b/recipes/pulseaudio/files/CVE-2009-1299.patch new file mode 100644 index 0000000000..63314b8280 --- /dev/null +++ b/recipes/pulseaudio/files/CVE-2009-1299.patch @@ -0,0 +1,86 @@ +From d3efa43d85ac132c6a5a416a2b6f2115f5d577ee Mon Sep 17 00:00:00 2001 +From: Kees Cook <kees@ubuntu.com> +Date: Tue, 2 Mar 2010 21:33:34 -0800 +Subject: [PATCH] core-util: ensure that we chmod only the dir we ourselves created + +--- + configure.ac | 2 +- + src/pulsecore/core-util.c | 39 ++++++++++++++++++++++++++++++++++----- + 2 files changed, 35 insertions(+), 6 deletions(-) + +Index: pulseaudio-0.9.15/configure.ac +=================================================================== +--- pulseaudio-0.9.15.orig/configure.ac 2010-03-17 14:50:02.000000000 +0800 ++++ pulseaudio-0.9.15/configure.ac 2010-03-17 14:52:27.250075828 +0800 +@@ -403,7 +403,7 @@ + AC_FUNC_FORK + AC_FUNC_GETGROUPS + AC_FUNC_SELECT_ARGTYPES +-AC_CHECK_FUNCS([chmod chown clock_gettime getaddrinfo getgrgid_r getgrnam_r \ ++AC_CHECK_FUNCS([chmod chown fstat fchown fchmod clock_gettime getaddrinfo getgrgid_r getgrnam_r \ + getpwnam_r getpwuid_r gettimeofday getuid inet_ntop inet_pton mlock nanosleep \ + pipe posix_fadvise posix_madvise posix_memalign setpgid setsid shm_open \ + sigaction sleep sysconf pthread_setaffinity_np]) +Index: pulseaudio-0.9.15/src/pulsecore/core-util.c +=================================================================== +--- pulseaudio-0.9.15.orig/src/pulsecore/core-util.c 2010-03-17 14:49:59.000000000 +0800 ++++ pulseaudio-0.9.15/src/pulsecore/core-util.c 2010-03-17 14:51:37.680079062 +0800 +@@ -178,7 +178,7 @@ + /** Creates a directory securely */ + int pa_make_secure_dir(const char* dir, mode_t m, uid_t uid, gid_t gid) { + struct stat st; +- int r, saved_errno; ++ int r, saved_errno, fd; + + pa_assert(dir); + +@@ -196,16 +196,45 @@ + if (r < 0 && errno != EEXIST) + return -1; + +-#ifdef HAVE_CHOWN ++#ifdef HAVE_FSTAT ++ if ((fd = open(dir, ++#ifdef O_CLOEXEC ++ O_CLOEXEC| ++#endif ++#ifdef O_NOCTTY ++ O_NOCTTY| ++#endif ++#ifdef O_NOFOLLOW ++ O_NOFOLLOW| ++#endif ++ O_RDONLY)) < 0) ++ goto fail; ++ ++ if (fstat(fd, &st) < 0) { ++ pa_assert_se(pa_close(fd) >= 0); ++ goto fail; ++ } ++ ++ if (!S_ISDIR(st.st_mode)) { ++ pa_assert_se(pa_close(fd) >= 0); ++ errno = EEXIST; ++ goto fail; ++ } ++ ++#ifdef HAVE_FCHOWN + if (uid == (uid_t)-1) + uid = getuid(); + if (gid == (gid_t)-1) + gid = getgid(); +- (void) chown(dir, uid, gid); ++ (void) fchown(fd, uid, gid); ++#endif ++ ++#ifdef HAVE_FCHMOD ++ (void) fchmod(fd, m); + #endif + +-#ifdef HAVE_CHMOD +- chmod(dir, m); ++ pa_assert_se(pa_close(fd) >= 0); ++ + #endif + + #ifdef HAVE_LSTAT diff --git a/recipes/pulseaudio/pulseaudio_0.9.15.bb b/recipes/pulseaudio/pulseaudio_0.9.15.bb index 64ca916659..760e408333 100644 --- a/recipes/pulseaudio/pulseaudio_0.9.15.bb +++ b/recipes/pulseaudio/pulseaudio_0.9.15.bb @@ -1,7 +1,7 @@ require pulseaudio.inc DEPENDS += "gdbm speex" -PR = "${INC_PR}.4" +PR = "${INC_PR}.5" inherit gettext @@ -15,6 +15,7 @@ SRC_URI += "\ file://fixbluezbuild.patch;patch=1 \ file://tls_m4.patch;patch=1 \ file://sbc-thumb.patch;patch=1 \ + file://CVE-2009-1299.patch;patch=1 \ " do_compile_prepend() { |