aboutsummaryrefslogtreecommitdiff
path: root/gnu/packages/patches/qemu-CVE-2015-4037.patch
diff options
context:
space:
mode:
authorMark H Weaver <mhw@netris.org>2015-06-15 23:57:14 -0400
committerMark H Weaver <mhw@netris.org>2015-06-16 00:29:28 -0400
commitfef3cfaaab972b1f514724f90050aeb38516519b (patch)
tree89d58b467be5e59263c1f41d06dfa4e08187eaf3 /gnu/packages/patches/qemu-CVE-2015-4037.patch
parent77ff9e9a994a3a23d973d87456a0085ac53b23bc (diff)
downloadguix-fef3cfaaab972b1f514724f90050aeb38516519b.tar
guix-fef3cfaaab972b1f514724f90050aeb38516519b.tar.gz
gnu: qemu: Add fixes for CVE-2015-{4037,4103,4104,4105,4106}.
* gnu/packages/patches/qemu-CVE-2015-4037.patch, gnu/packages/patches/qemu-CVE-2015-4103.patch, gnu/packages/patches/qemu-CVE-2015-4104.patch, gnu/packages/patches/qemu-CVE-2015-4105.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt1.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt2.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt3.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt4.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt5.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt6.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt7.patch, gnu/packages/patches/qemu-CVE-2015-4106-pt8.patch: New files. * gnu-system.am (dist_patch_DATA): Add them. * gnu/packages/qemu.scm (qemu-headless)[source]: Add patches.
Diffstat (limited to 'gnu/packages/patches/qemu-CVE-2015-4037.patch')
-rw-r--r--gnu/packages/patches/qemu-CVE-2015-4037.patch53
1 files changed, 53 insertions, 0 deletions
diff --git a/gnu/packages/patches/qemu-CVE-2015-4037.patch b/gnu/packages/patches/qemu-CVE-2015-4037.patch
new file mode 100644
index 0000000000..305036b9f2
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2015-4037.patch
@@ -0,0 +1,53 @@
+From 8b8f1c7e9ddb2e88a144638f6527bf70e32343e3 Mon Sep 17 00:00:00 2001
+From: Michael Tokarev <mjt@tls.msk.ru>
+Date: Thu, 28 May 2015 14:12:26 +0300
+Subject: [PATCH] slirp: use less predictable directory name in /tmp for smb
+ config (CVE-2015-4037)
+
+In this version I used mkdtemp(3) which is:
+
+ _BSD_SOURCE
+ || /* Since glibc 2.10: */
+ (_POSIX_C_SOURCE >= 200809L || _XOPEN_SOURCE >= 700)
+
+(POSIX.1-2008), so should be available on systems we care about.
+
+While at it, reset the resulting directory name within smb structure
+on error so cleanup function wont try to remove directory which we
+failed to create.
+
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+Reviewed-by: Markus Armbruster <armbru@redhat.com>
+---
+ net/slirp.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/net/slirp.c b/net/slirp.c
+index 0e15cf6..3533837 100644
+--- a/net/slirp.c
++++ b/net/slirp.c
+@@ -481,7 +481,6 @@ static void slirp_smb_cleanup(SlirpState *s)
+ static int slirp_smb(SlirpState* s, const char *exported_dir,
+ struct in_addr vserver_addr)
+ {
+- static int instance;
+ char smb_conf[128];
+ char smb_cmdline[128];
+ struct passwd *passwd;
+@@ -505,10 +504,10 @@ static int slirp_smb(SlirpState* s, const char *exported_dir,
+ return -1;
+ }
+
+- snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.%ld-%d",
+- (long)getpid(), instance++);
+- if (mkdir(s->smb_dir, 0700) < 0) {
++ snprintf(s->smb_dir, sizeof(s->smb_dir), "/tmp/qemu-smb.XXXXXX");
++ if (!mkdtemp(s->smb_dir)) {
+ error_report("could not create samba server dir '%s'", s->smb_dir);
++ s->smb_dir[0] = 0;
+ return -1;
+ }
+ snprintf(smb_conf, sizeof(smb_conf), "%s/%s", s->smb_dir, "smb.conf");
+--
+2.2.1
+