From: VMware, Inc <>
Date: Thu, 2 Aug 2012 06:50:06 +0000 (-0700)
Subject: lib/file: fix potential crash in FileRotateBy*()
X-Git-Tag: 2012.10.14-874563~66
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=df2c0d4438878904db755c6d4bc5015b7129e64d;p=thirdparty%2Fopen-vm-tools.git

lib/file: fix potential crash in FileRotateBy*()

The File_Rotate call may have a newFileName argument. If there is a
failure, and this argument is present we should set it to NULL to
prevent potential memory corruption or freeing garbage problems.

Signed-off-by: Dmitry Torokhov <dtor@vmware.com>
---

diff --git a/open-vm-tools/lib/file/file.c b/open-vm-tools/lib/file/file.c
index cbd7f8bc8..1c5d8ec04 100644
--- a/open-vm-tools/lib/file/file.c
+++ b/open-vm-tools/lib/file/file.c
@@ -2235,6 +2235,10 @@ FileRotateByRename(const char *fileName,  // IN: full path to file
    int i;
    int result;
 
+   if (newFileName != NULL) {
+      *newFileName = NULL;
+   }
+
    for (i = n; i >= 0; i--) {
       src = (i == 0) ? (char *) fileName :
                        Str_SafeAsprintf(NULL, "%s-%d%s", baseName, i - 1, ext);
@@ -2259,8 +2263,8 @@ FileRotateByRename(const char *fileName,  // IN: full path to file
          }
       }
 
-      if ((src == fileName) && (newFileName != NULL)) {
-         *newFileName = result == -1 ? NULL : strdup(dst);
+      if ((src == fileName) && (newFileName != NULL) && (result == 0)) {
+         *newFileName = Util_SafeStrdup(dst);
       }
 
       ASSERT(dst != fileName);
@@ -2333,6 +2337,10 @@ FileRotateByRenumber(const char *filePath,       // IN: full path to file
    uint32 *fileNumbers = NULL;
    int result;
 
+   if (newFilePath != NULL) {
+      *newFilePath = NULL;
+   }
+
    fullPathNoExt = File_FullPath(filePathNoExt);
    if (fullPathNoExt == NULL) {
       Log(LGPFX" %s: failed to get full path for '%s'.\n", __FUNCTION__,
@@ -2396,7 +2404,6 @@ FileRotateByRenumber(const char *filePath,       // IN: full path to file
 
    if (newFilePath != NULL) {
       if (result == -1) {
-         *newFilePath = NULL;
          free(tmp);
       } else {
          *newFilePath = tmp;