CodeSonar : irssi-0.8.14 : File System Race Condition

irssi-0.8.14 : irssi-0.8.14 analysis 2 : File System Race Condition at dcc-get.c:250

Categories:	IO.RACE CWE:367
Warning ID:	22015.28347
Procedure:	sig_dccget_connected
Trace:	view
Modified:	Thu Nov 26 11:08:58 2009 show details hide details

Priority:	None
State:	None
Finding:	None
Owner:	None
	edit properties

Legend	[ X ]
Warning Location Contributes Parse Error Other Warning Two or More Loop Iterations On Execution Path Comment Macro Preprocessor Include Keyword Preprocessed Away

Legend
Warning Location	Contributes	Parse Error
Other Warning	Two or More Loop Iterations	On Execution Path
Comment	Macro	Preprocessor
Include	Keyword	Preprocessed Away

Source | Language: C

Hide Legend

Problem	Line	Source

			/kat0/fletcher/SATE/2010/irssi-0.8.14/src/irc/dcc/dcc-get.c

			Enter sig_dccget_connected

174

void sig_dccget_connected(GET_DCC_REC *dcc)

175

{

176

struct stat statbuf;

177

char *fname, *tempfname, *str;

178

int ret, ret_errno, temphandle, old_umask;

179

180

if (!dcc->from_dccserver) {

181

if (net_geterror(dcc->handle ) != 0) {

182

/* error connecting */

183

signal_emit("dcc error connect", 1, dcc );

184

dcc_destroy(DCC(dcc));

return;

}

g_source_remove(dcc->tagconn);

dcc->tagconn = -1;

}

g_free_not_null(dcc->file);

193

dcc->file = dcc_get_download_path(dcc->arg );

194

195

/* if some plugin wants to change the file name/path here.. */

196

signal_emit("dcc get receive", 1, dcc );

197

198

if (stat(dcc->file, &statbuf) == 0 &&

199

dcc->get_type == DCC_GET_RENAME) {

200

/* file exists, rename.. */

201

fname = dcc_get_rename_file(dcc->file );

g_free(dcc->file);

dcc->file = fname;

}

if (dcc->get_type != DCC_GET_RESUME) {

207

int dcc_file_create_mode = octal2dec(settings_get_int("dcc_file_create_mode"));

208

209

/* we want to overwrite the file, remove it here.

210

if it gets created after this, we'll fail. */

211

unlink(dcc->file);

212

213

/* just to make sure we won't run into race conditions

214

if download_path is in some global temp directory */

215

tempfname = g_strconcat(dcc->file, ".XXXXXX", NULL);

216

217

old_umask = umask(0077);

218

temphandle = mkstemp(tempfname);

219

umask(old_umask);

220

221

if (temphandle == -1)

222

ret = -1;

223

else

224

ret = fchmod(temphandle, dcc_file_create_mode);

225

226

if (ret != -1) {

227

ret = link(tempfname, dcc->file); /* File System Race Condition (ID: 7264.28349) */

if (ret == -1 &&

/* Linux */

(errno == EPERM ||

/* FUSE */

errno == ENOSYS ||

/* BSD */

errno == EOPNOTSUPP)) {

236

/* hard links aren't supported - some people

237

want to download stuff to FAT/NTFS/etc

238

partitions, so fallback to rename() */

true

239

ret = rename(tempfname, dcc->file); /* File System Race Condition (ID: 7263.28348) */

}

}

/* if ret = 0, we're the file owner now */

244

dcc->fhandle = ret == -1 ? -1 :

245

open(dcc->file, O_WRONLY | O_TRUNC);

246

247

/* close/remove the temp file */

248

ret_errno = errno;

249

close(temphandle); /* Negative file descriptor (ID: 7265.28350) */

*tempfname is accessed by path name

250

unlink(tempfname); /* File System Race Condition */

Preconditions

&$unknown_320027 != -1
dcc->from_dccserver = 0

Postconditions

$unknown_320023' is accessed by path name
$unknown_320025' is accessed by path name
errno' != 0
fname' = &$unknown_320023
old_umask' = 63
ret' = 0
ret_errno' = 95
tempfname' = &$unknown_320025
temphandle' = &$unknown_320027

Change Warning 22015.28347 : File System Race Condition

Priority:
State:
Finding:
Owner:
Note: