backport fix for CVE-2008-4865 from trunk (r8798)

git-svn-id: svn://svn.valgrind.org/valgrind/branches/VALGRIND_3_3_BRANCH@8800

diff --git a/coregrind/m_commandline.c b/coregrind/m_commandline.c
index 19ad82a06d1419b5b5e2bf7812b99d3bebf38c3c..b6b8e66f866cce5cae78c1376185249ed41af747 100644 (file)
--- a/coregrind/m_commandline.c
+++ b/coregrind/m_commandline.c
@@ -57,23 +57,33 @@ static HChar* read_dot_valgrindrc ( HChar* dir )
 {
    Int    n;
    SysRes fd;
-   Int    size;
+   struct vki_stat stat_buf;
    HChar* f_clo = NULL;
    HChar  filename[VKI_PATH_MAX];
 
    VG_(snprintf)(filename, VKI_PATH_MAX, "%s/.valgrindrc", 
                            ( NULL == dir ? "" : dir ) );
    fd = VG_(open)(filename, 0, VKI_S_IRUSR);
+
    if ( !fd.isError ) {
-      size = VG_(fsize)(fd.res);
-      if (size > 0) {
-         f_clo = VG_(malloc)(size+1);
-         vg_assert(f_clo);
-         n = VG_(read)(fd.res, f_clo, size);
-         if (n == -1) n = 0;
-         vg_assert(n >= 0 && n <= size+1);
-         f_clo[n] = '\0';
+      Int res = VG_(fstat)( fd.res, &stat_buf );
+      // Ignore if not owned by current user or world writeable (CVE-2008-4865)
+      if (!res && stat_buf.st_uid == VG_(geteuid)()
+          && (!(stat_buf.st_mode & VKI_S_IWOTH))) {
+         if ( stat_buf.st_size > 0) {
+            f_clo = VG_(malloc)(stat_buf.st_size+1);
+            vg_assert(f_clo);
+            n = VG_(read)(fd.res, f_clo, stat_buf.st_size);
+            if (n == -1) n = 0;
+            vg_assert(n >= 0 && n <= stat_buf.st_size+1);
+            f_clo[n] = '\0';
+         }
       }
+      else
+         VG_(message)(Vg_UserMsg,
+               "%s was not read as it is world writeable or not owned by the "
+               "current user", filename);
+
       VG_(close)(fd.res);
    }
    return f_clo;

diff --git a/docs/xml/manual-core.xml b/docs/xml/manual-core.xml
index 9924187f6136d42904668648e94e8c1becb100be..b54f5f39647e1bc09ec9ed217594ad708d0c6bad 100644 (file)
--- a/docs/xml/manual-core.xml
+++ b/docs/xml/manual-core.xml
@@ -1255,7 +1255,14 @@ processed earlier; for example, options in
 precedence over those in
 <computeroutput>~/.valgrindrc</computeroutput>.  The first two
 are particularly useful for setting the default tool to
-use.</para>
+</para>
+
+<para>Please note that the <computeroutput>./.valgrindrc</computeroutput>
+file is ignored if it is marked as world writeable or not owned
+by the current user. This is because the .valgrindrc can contain options
+that are potentially harmful or can be used by a local attacker to
+execute code under your user account.
+</para>
 
 <para>Any tool-specific options put in
 <computeroutput>$VALGRIND_OPTS</computeroutput> or the