Re: Fw: [Groff] Bug#56702: [PATCH] security bugfix for grohtml

[Gaius Mulley]

Werner writes:

> can you take care of the grohtml related fixes of this bug report?  I
> would prefer if you could handle this...

sure ok, here is Colin's fix with a couple of extra mods.

cheers Gaius


--- groff-cvs/src/devices/grohtml/html.cc       Sun Feb  6 09:37:40 2000
+++ groff-html/src/devices/grohtml/html.cc      Mon Feb  7 14:57:16 2000
@@ -35,6 +35,9 @@
 #include <unistd.h>
 #endif
 
+#include <stdio.h>
+#include <fcntl.h>
+
 #include "ordered_list.h"
 
 #if !defined(TRUE)
@@ -1547,8 +1550,11 @@
 void html_printer::make_new_image_name (void)
 {
   image_number++;
-  if ((strcmp(current_filename, "<standard input>") == 0) ||
-      (strcmp(current_filename, "-") == 0)) {
+
+  if ((current_filename == 0) ||
+      (strcmp(current_filename, "<standard input>") == 0) ||
+      (strcmp(current_filename, "-") == 0) ||
+      (strchr(current_filename, '/') != 0)) {
     sprintf(image_name, "grohtml-%d-%ld", image_number, (long)getpid());
   } else {
     sprintf(image_name, "%s-%d-%ld", current_filename, image_number, 
(long)getpid());
@@ -2402,18 +2408,27 @@
   return( (g->minv < t->minv) || ((g->minv == t->minv) && (g->minh < t->minh)) 
);
 }
 
-static FILE *create_file (char *filename)
+/*
+ *  create_tmp_file - opens a filename in /tmp carefully checking for failure
+ *                    otherwise security could be circumvented.
+ */
+
+static FILE *create_tmp_file (char *filename)
 {
   FILE *f;
+  int   fd;
 
   errno = 0;
-  f = fopen(filename, "w");
+  /* This file is in /tmp, so open carefully */
+  fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, 0600);
+  if (fd < 0) {
+    fatal("can't create `%1'", filename);
+  }
+  f  = fdopen(fd, "w");
   if (f == 0) {
-    error("can't create `%1'", filename);
-    return( 0 );
-  } else {
-    return( f );
+    fatal("can't create `%1'", filename);
   }
+  return( f );
 }
 
 void html_printer::convert_to_image (char *name)
@@ -2490,7 +2505,7 @@
   if (! is_to_html) {
     is_center = html_position_region();
     create_temp_name(name, "troff");
-    f = create_file(name);
+    f = create_tmp_file(name);
     troff.set_file(f);
     prologue();
     output_style.f = 0;
--- groff-cvs/src/devices/grohtml/ChangeLog     Sun Feb  6 09:37:28 2000
+++ groff-html/src/devices/grohtml/ChangeLog    Mon Feb  7 14:57:24 2000
@@ -1,3 +1,12 @@
+2000-02-07  Gaius Mulley  <address@hidden>
+
+       * html.cc: tidied up html.cc and fixed name of image if
+       the source file is in a different directory.
+       
+2000-02-07  Colin Phipps <address@hidden>
+
+       * html.cc: identified & fixed security bug when creating files in /tmp
+
 2000-01-28  Gaius Mulley  <address@hidden>
 
        * html.cc: Minor fixes.