a0119ff1d2
1 OBS-URL: https://build.opensuse.org/request/show/501456 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libqt5-qtbase?expand=0&rev=59
34 lines
1.5 KiB
Diff
34 lines
1.5 KiB
Diff
From e840a7ed21bc8e93e2e87fec25dd98aa0039fca1 Mon Sep 17 00:00:00 2001
|
|
From: Antonio Larrosa <larrosa@kde.org>
|
|
Date: Tue, 18 Apr 2017 17:56:35 +0200
|
|
Subject: [PATCH] Fix open/chmod race condition in QSaveFile
|
|
|
|
This fixes a problem introduced in a60571b3700e80f44705ebc4bab9628cf852891c
|
|
by which a temporary file could be created with mode 0666 (0644 after
|
|
applying umask), and then changed to 0600, but in the meantime it would
|
|
be possible for anyone to get a working file descriptor that could be used
|
|
to read the file. See https://bugzilla.suse.com/show_bug.cgi?id=1034005.
|
|
|
|
Change-Id: I824025f54d6faf853da88e4dfcb092b577b4df04
|
|
---
|
|
src/corelib/io/qsavefile.cpp | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/corelib/io/qsavefile.cpp b/src/corelib/io/qsavefile.cpp
|
|
index 5a325f8e2c..af90b96d82 100644
|
|
--- a/src/corelib/io/qsavefile.cpp
|
|
+++ b/src/corelib/io/qsavefile.cpp
|
|
@@ -216,7 +216,8 @@ bool QSaveFile::open(OpenMode mode)
|
|
}
|
|
|
|
d->fileEngine = new QTemporaryFileEngine;
|
|
- static_cast<QTemporaryFileEngine *>(d->fileEngine)->initialize(d->finalFileName, 0666);
|
|
+ int perm = (existingFile.exists() ? 0600 : 0666);
|
|
+ static_cast<QTemporaryFileEngine *>(d->fileEngine)->initialize(d->finalFileName, perm);
|
|
// Same as in QFile: QIODevice provides the buffering, so there's no need to request it from the file engine.
|
|
if (!d->fileEngine->open(mode | QIODevice::Unbuffered)) {
|
|
QFileDevice::FileError err = d->fileEngine->error();
|
|
--
|
|
2.12.2
|
|
|