aniani/ezstream
1
0
Fork 0
mirror of https://gitlab.xiph.org/xiph/ezstream.git synced 2024-11-03 04:17:18 -05:00
Code

Do not execute group-/world-writeable playlist and metadata scripts.

Browse Source 
git-svn-id: https://svn.xiph.org/trunk/ezstream@12712 0101bb08-14d6-0310-b084-bc0e0c8e3800
This commit is contained in:
moritz 2007-03-10 21:23:15 +00:00
parent 6eb5d8f557
commit 1d4426e834
3 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -7,6 +7,7 @@ Changes in 0.4.0, (SVN trunk):
* src/playlist.*: * src/playlist.*:
- [FIX] An error compareable to the one about xfree() in src/util.* has - [FIX] An error compareable to the one about xfree() in src/util.* has
been fixed. been fixed.
- [MISC] Refuse to execute a group- or world-writeable playlist script.
* src/compat.c: * src/compat.c:
- [ADD] Implement a basename() function for Windows that behaves like the - [ADD] Implement a basename() function for Windows that behaves like the

6
src/metadata.c
View File

@ -364,6 +364,12 @@ metadata_program(const char *program)
metadata_free(&md); metadata_free(&md);
return (NULL); return (NULL);
} }
if (st.st_mode & (S_IWGRP | S_IWOTH)) {
printf("%s: Error: %s is group and/or world writeable\n",
__progname, program);
metadata_free(&md);
return (NULL);
}
if (!(st.st_mode & (S_IEXEC | S_IXGRP | S_IXOTH))) { if (!(st.st_mode & (S_IEXEC | S_IXGRP | S_IXOTH))) {
printf("%s: %s: Not an executable program\n", __progname, program); printf("%s: %s: Not an executable program\n", __progname, program);
metadata_free(&md); metadata_free(&md);

6
src/playlist.c
View File

@ -218,6 +218,12 @@ playlist_program(const char *filename)
playlist_free(&pl); playlist_free(&pl);
return (NULL); return (NULL);
} }
if (st.st_mode & (S_IWGRP | S_IWOTH)) {
printf("%s: Error: %s is group and/or world writeable\n",
__progname, filename);
playlist_free(&pl);
return (NULL);
}
if (!(st.st_mode & (S_IEXEC | S_IXGRP | S_IXOTH))) { if (!(st.st_mode & (S_IEXEC | S_IXGRP | S_IXOTH))) {
printf("%s: %s: Not an executable program\n", __progname, filename); printf("%s: %s: Not an executable program\n", __progname, filename);
playlist_free(&pl); playlist_free(&pl);