- markus@cvs.openbsd.org 2003/02/06 09:29:18
[sftp-server.c]
fix races in rename/symlink; from Tony Finch; ok djm@
diff --git a/sftp-server.c b/sftp-server.c
index 8426469..4eb31d9 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -22,7 +22,7 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "includes.h"
-RCSID("$OpenBSD: sftp-server.c,v 1.38 2002/09/11 22:41:50 djm Exp $");
+RCSID("$OpenBSD: sftp-server.c,v 1.39 2003/02/06 09:29:18 markus Exp $");
#include "buffer.h"
#include "bufaux.h"
@@ -832,19 +832,22 @@
process_rename(void)
{
u_int32_t id;
- struct stat st;
char *oldpath, *newpath;
- int ret, status = SSH2_FX_FAILURE;
+ int status;
id = get_int();
oldpath = get_string(NULL);
newpath = get_string(NULL);
TRACE("rename id %u old %s new %s", id, oldpath, newpath);
/* fail if 'newpath' exists */
- if (stat(newpath, &st) == -1) {
- ret = rename(oldpath, newpath);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
- }
+ if (link(oldpath, newpath) == -1)
+ status = errno_to_portable(errno);
+ else if (unlink(oldpath) == -1) {
+ status = errno_to_portable(errno);
+ /* clean spare link */
+ unlink(newpath);
+ } else
+ status = SSH2_FX_OK;
send_status(id, status);
xfree(oldpath);
xfree(newpath);
@@ -878,19 +881,16 @@
process_symlink(void)
{
u_int32_t id;
- struct stat st;
char *oldpath, *newpath;
- int ret, status = SSH2_FX_FAILURE;
+ int ret, status;
id = get_int();
oldpath = get_string(NULL);
newpath = get_string(NULL);
TRACE("symlink id %u old %s new %s", id, oldpath, newpath);
- /* fail if 'newpath' exists */
- if (stat(newpath, &st) == -1) {
- ret = symlink(oldpath, newpath);
- status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
- }
+ /* this will fail if 'newpath' exists */
+ ret = symlink(oldpath, newpath);
+ status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
xfree(oldpath);
xfree(newpath);