Re: lpd: race condition

2014-01-19 Thread Tobias Stoeckmann
On Mon, Jan 20, 2014 at 10:11:53AM +1300, Philip Guenther wrote: > On Sun, Jan 19, 2014 at 10:48 AM, Todd C. Miller > wrote: > > Perhaps something like this? Only compile-tested. > > Looks good. We also need to fix the 'S' line parsing code in sendit() > and printit() in lpd/printjob.c to use u

Re: lpd: race condition

2014-01-19 Thread Philip Guenther
On Sun, Jan 19, 2014 at 10:48 AM, Todd C. Miller wrote: > Perhaps something like this? Only compile-tested. Looks good. We also need to fix the 'S' line parsing code in sendit() and printit() in lpd/printjob.c to use unsigned long long when parsing the ino_t instead of trying to store it in an

Re: lpd: race condition

2014-01-18 Thread Todd C. Miller
Perhaps something like this? Only compile-tested. - todd Index: usr.sbin/lpr/lpd/printjob.c === RCS file: /home/cvs/openbsd/src/usr.sbin/lpr/lpd/printjob.c,v retrieving revision 1.49 diff -u -r1.49 printjob.c --- usr.sbin/lpr/lpd/p

Re: lpd: race condition

2014-01-17 Thread Todd C. Miller
On Fri, 17 Jan 2014 21:49:53 +0100, Tobias Stoeckmann wrote: > lpd wants to verify that it doesn't open a symbolic link, checking with > lstat(), then open()ing the file. The only reason I can see that the > code does not simply use O_NOFOLLOW is a different return value if > it encounters a syml

lpd: race condition

2014-01-17 Thread Tobias Stoeckmann
Hi, lpd wants to verify that it doesn't open a symbolic link, checking with lstat(), then open()ing the file. The only reason I can see that the code does not simply use O_NOFOLLOW is a different return value if it encounters a symlink (maybe I am wrong here, would like to get feedback on this as