Package: sudo / 1.8.5p2-1+nmu3+deb7u1

CVE-2015-5602-4.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
Description: Remove S_ISREG check from sudo_edit_open(), it is already done in the caller.
Origin: https://www.sudo.ws/repos/sudo/rev/9fff8c0bb1f7
Bug: https://bugzilla.sudo.ws/show_bug.cgi?id=707
Bug-Debian: https://bugs.debian.org/804149
Author: Todd C. Miller <Todd.Miller@courtesan.com>
Author: Ben Hutchings <ben@decadent.org.uk>
Applied-Upstream: 1.8.15

--- a/src/sudo_edit.c
+++ b/src/sudo_edit.c
@@ -85,20 +85,12 @@ static int
 sudo_edit_open(const char *path, int oflags, mode_t mode, int sflags)
 {
     int fd;
-    struct stat sb;
 
     if (!ISSET(sflags, CD_SUDOEDIT_FOLLOW))
 	oflags |= O_NOFOLLOW;
     fd = open(path, oflags|O_NONBLOCK, mode);
-    if (fd != -1) {
-	if (!ISSET(oflags, O_NONBLOCK))
-	    (void) fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
-	if (fstat(fd, &sb) == -1 || !S_ISREG(sb.st_mode)) {
-	    close(fd);
-	    fd = -1;
-	    errno = EINVAL;
-	}
-    }
+    if (fd != -1 && !ISSET(oflags, O_NONBLOCK))
+	(void) fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);
     return fd;
 }
 #else
@@ -123,15 +115,6 @@ sudo_edit_open(const char *path, int ofl
 	return -1;
     }
 
-    /*
-     * Only open regular files.
-     */
-    if (!S_ISREG(sb1.st_mode)) {
-	close(fd);
-	errno = EINVAL;
-	return -1;
-    }
-
     /*
      * Make sure we did not open a link and that what we opened
      * matches what is currently on the file system.