1 From: NeilBrown <neilb@suse.de>
2 Date: Mon, 23 May 2011 12:19:57 +0000 (-0400)
3 Subject: Remove risk of nfs_addmntent corrupting mtab
4 X-Git-Url: http://git.linux-nfs.org/?p=steved%2Fnfs-utils.git;a=commitdiff_plain;h=7a802337bfc92d0b30fe94dbd0fa231990a26161
6 Remove risk of nfs_addmntent corrupting mtab
8 nfs_addmntent is used to append directly to /etc/mtab.
9 If the write partially fail, e.g. due to RLIMIT_FSIZE,
10 truncate back to original size and return an error.
12 See also https://bugzilla.redhat.com/show_bug.cgi?id=697975
13 (CVE-2011-1749) CVE-2011-1749 nfs-utils: mount.nfs fails to anticipate RLIMIT_FSIZE
15 Signed-off-by: NeilBrown <neilb@suse.de>
16 Signed-off-by: Steve Dickson <steved@redhat.com>
19 diff --git a/support/nfs/nfs_mntent.c b/support/nfs/nfs_mntent.c
20 index a5216fc..a2118a2 100644
21 --- a/support/nfs/nfs_mntent.c
22 +++ b/support/nfs/nfs_mntent.c
24 #include <string.h> /* for index */
25 #include <ctype.h> /* for isdigit */
26 #include <sys/stat.h> /* for umask */
27 +#include <unistd.h> /* for ftruncate */
29 #include "nfs_mntent.h"
31 @@ -127,9 +128,11 @@ int
32 nfs_addmntent (mntFILE *mfp, struct mntent *mnt) {
33 char *m1, *m2, *m3, *m4;
37 if (fseek (mfp->mntent_fp, 0, SEEK_END))
38 return 1; /* failure */
39 + length = ftell(mfp->mntent_fp);
41 m1 = mangle(mnt->mnt_fsname);
42 m2 = mangle(mnt->mnt_dir);
43 @@ -143,6 +146,12 @@ nfs_addmntent (mntFILE *mfp, struct mntent *mnt) {
48 + res = fflush(mfp->mntent_fp);
50 + /* Avoid leaving a corrupt mtab file */
51 + ftruncate(fileno(mfp->mntent_fp), length);
53 return (res < 0) ? 1 : 0;