1232943 - [CID 749674] NSS TOCTOU

Status: RESOLVED INVALID

(NSS :: Libraries, defect)

Description

[Franziskus Kiefer [:franziskus]]

Possible TOCTOU between stat(path, &sbuf) and open(path, in the following code

mktemp.c:102
>	for (start = trv + 1;; --trv) {
>		char saved;
>		if (trv <= path)
>			break;
>		saved = *trv;
>		if (saved == '/' || saved == '\\') {
>			int rv;
>			*trv = '\0';
>			rv = stat(path, &sbuf);
>			*trv = saved;
>			if (rv)
>				return(0);
>			if (!S_ISDIR(sbuf.st_mode)) {
>				errno = ENOTDIR;
>				return(0);
>			}
>			break;
>		}
>	}
> 
>	for (;;) {
>		if (doopen) {
>			if ((*doopen =
>			    open(path, O_CREAT|O_EXCL|O_RDWR|extraFlags, 0600)) = 0)
>				return(1);
>			if (errno != EEXIST)
>				return(0);
>		}

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

I don't think this is a problem. Due to the temporarily placed null characters, the calls to stat are never the same as what's passed to open.