SECURITY fix: when spawning mksh on a new terminal (tty, not /dev/null),

flush all of its I/O first – someone could have written on it beforehand
This commit is contained in:
tg
2008-04-11 19:55:24 +00:00
parent afaa3ffa59
commit fc607a6c1b
3 changed files with 13 additions and 9 deletions

14
misc.c
View File

@ -6,7 +6,7 @@
#include <grp.h>
#endif
__RCSID("$MirOS: src/bin/mksh/misc.c,v 1.71 2008/04/01 21:50:58 tg Exp $\t"
__RCSID("$MirOS: src/bin/mksh/misc.c,v 1.72 2008/04/11 19:55:23 tg Exp $\t"
MKSH_SH_H_ID);
#undef USE_CHVT
@ -1370,16 +1370,20 @@ chvt(const char *fn)
}
switch (fork()) {
case -1:
errorf("fork failed");
errorf("chvt: %s failed", "fork");
case 0:
break;
default:
exit(0);
}
if (setsid() == -1)
errorf("chvt: setsid failed");
if ((fn != dv + 1) && ioctl(fd, TIOCSCTTY, NULL) == -1)
errorf("chvt: TIOCSCTTY failed");
errorf("chvt: %s failed", "setsid");
if (fn != dv + 1) {
if (ioctl(fd, TIOCSCTTY, NULL) == -1)
errorf("chvt: %s failed", "TIOCSCTTY");
if (tcflush(fd, TCIOFLUSH))
errorf("chvt: %s failed", "TCIOFLUSH");
}
ksh_dup2(fd, 0, false);
ksh_dup2(fd, 1, false);
ksh_dup2(fd, 2, false);