Attachment 4969 Details for Bug 5898 – Proposed fix to xdm modular tree

[patch] Proposed fix to xdm modular tree

xdm.patch (text/plain), 3.41 KB, created by Alan Coopersmith on 2006-03-17 06:45:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alan Coopersmith

Created: 2006-03-17 06:45:44 UTC

Size: 3.41 KB

patch

obsolete

>Index: configure.ac
>===================================================================
>RCS file: /cvs/xorg/app/xdm/configure.ac,v
>retrieving revision 1.32
>diff -u -r1.32 configure.ac
>--- configure.ac	25 Feb 2006 02:21:51 -0000	1.32
>+++ configure.ac	16 Mar 2006 19:40:26 -0000
>@@ -35,6 +35,11 @@
> 
> XORG_PROG_RAWCPP
> 
>+# Check for mktemp to prevent security issue noted in Xorg bug #5898
>+# See https://bugs.freedesktop.org/show_bug.cgi?id=5898 for details.
>+AC_PATH_PROG(MKTEMP_COMMAND, mktemp)
>+AM_CONDITIONAL(HAVE_MKTEMP_COMMAND, test x$MKTEMP_COMMAND != x)
>+
> AC_FUNC_FORK
> 
> dnl If you're looking here because you got a message that said
>@@ -217,7 +222,8 @@
> AC_SUBST(SERVERSTYPE)
> 
> case $host_os in
>-    *sco*)	SHELL_CMD="/bin/ksh"	;;
>+    *sco*|*solaris*)
>+		SHELL_CMD="/bin/ksh"	;;
>     *)		SHELL_CMD="/bin/sh"	;;
> esac
> AC_SUBST(SHELL_CMD)
>@@ -477,6 +483,7 @@
> PKG_CHECK_MODULES(APPDEFS, xt)
> appdefaultdir=$(pkg-config --variable=appdefaultdir xt)
> AC_SUBST(appdefaultdir)
>+AC_SUBST(MKTEMP_COMMAND)
> 
> XORG_MANPAGE_SECTIONS
> XORG_RELEASE_VERSION
>Index: config/Makefile.am
>===================================================================
>RCS file: /cvs/xorg/app/xdm/config/Makefile.am,v
>retrieving revision 1.8
>diff -u -r1.8 Makefile.am
>--- config/Makefile.am	11 Dec 2005 20:43:49 -0000	1.8
>+++ config/Makefile.am	16 Mar 2006 19:40:26 -0000
>@@ -1,4 +1,4 @@
>-# $Id: Makefile.am,v 1.7 2005/11/08 07:50:12 alanc Exp $
>+# $XdotOrg: $
> #
> 
> include $(top_srcdir)/cpprules.in
>@@ -46,11 +46,15 @@
>         -DXDM_BWPIXMAP=$(XDM_BWPIXMAP)
> #endif
> 
>+#if HAVE_MKTEMP_COMMAND
>+MKTEMP_DEFINES = -DMKTEMP_COMMAND=$(MKTEMP_COMMAND)
>+#endif
>+
> CPP_FILES_FLAGS = -DBINDIR=$(bindir) -DDEFAULTVT=$(DEFAULTVT) \
>     -DXDMDIR=$(XDMLIBDIR) -DXDMLOGDIR=$(XDMLOGDIR) -DXDMPIDDIR=$(XDMPIDDIR) \
>     -DXDMCONFIGDIR=$(XDMCONFIGDIR) -DXDMSCRIPTDIR=$(XDMSCRIPTDIR) \
>     -DSU=$(SU) -DCHOOSERPATH=$(XDMLIBDIR)/chooser $(XPMDEFINES) \
>-    -DSHELL_CMD=$(SHELL_CMD)
>+    -DSHELL_CMD=$(SHELL_CMD) $(MKTEMP_DEFINES)
> 
> Xservers.ws: $(srcdir)/Xservers.ws.cpp
> 	$(RAWCPP) $(RAWCPPFLAGS) $(CPP_FILES_FLAGS) < $(srcdir)/Xservers.ws.cpp | $(CPP_SED_MAGIC) > $@
>Index: config/Xsession.cpp
>===================================================================
>RCS file: /cvs/xorg/app/xdm/config/Xsession.cpp,v
>retrieving revision 1.3
>diff -u -r1.3 Xsession.cpp
>--- config/Xsession.cpp	24 Feb 2006 21:36:13 -0000	1.3
>+++ config/Xsession.cpp	16 Mar 2006 19:40:26 -0000
>@@ -1,17 +1,36 @@
> XCOMM!SHELL_CMD
> XCOMM
>+XCOMM $XdotOrg: $
> XCOMM $Xorg: Xsession,v 1.4 2000/08/17 19:54:17 cpqbld Exp $
> XCOMM $XFree86: xc/programs/xdm/config/Xsession,v 1.2 1998/01/11 03:48:32 dawes Exp $
> 
> XCOMM redirect errors to a file in user's home directory if we can
>-for errfile in "$HOME/.xsession-errors" "${TMPDIR-/tmp}/xses-$USER" "/tmp/xses-$USER"
>-do
>-	if ( umask 077 && cp /dev/null "$errfile" 2> /dev/null )
>-	then
>-		exec > "$errfile" 2>&1
>-		break
>-	fi
>-done
>+errfile="$HOME/.xsession-errors"
>+if ( umask 077 && cp /dev/null "$errfile" 2> /dev/null )
>+then
>+	exec > "$errfile" 2>&1
>+else
>+#ifdef MKTEMP_COMMAND
>+	mktemp=MKTEMP_COMMAND
>+#endif
>+	for errfile in "${TMPDIR-/tmp}/xses-$USER" "/tmp/xses-$USER"
>+	do
>+#ifdef MKTEMP_COMMAND
>+		if ef="$( $mktemp "$errfile.XXXXXX" 2> /dev/null)"
>+		then
>+			exec > "$ef" 2>&1
>+			mv "$ef" "$errfile" 2> /dev/null
>+ 			break
>+ 		fi
>+#else
>+		if ( umask 077 && cp /dev/null "$errfile" 2> /dev/null )
>+		then
>+			exec > "$errfile" 2>&1
>+			break
>+		fi
>+#endif
>+	done
>+fi
> 
> case $# in
> 1)

Actions: View | Splinter Review

Attachments on bug 5898: 4969

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.