From 82bea520c7c037f861cf27859a194bb64559f835 Mon Sep 17 00:00:00 2001 From: Jakub Filak Date: Sat, 23 May 2015 01:10:16 +0200 Subject: [LIBREPORT PATCH] dd: add missing return statement The missing return allows abrt-dbus to read any file on system (absolute paths do not work because of an assert but relative paths allow an attacker to read everything). Related: #1217484 Signed-off-by: Jakub Filak --- src/lib/dump_dir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/lib/dump_dir.c b/src/lib/dump_dir.c index 32f498b..796f947 100644 --- a/src/lib/dump_dir.c +++ b/src/lib/dump_dir.c @@ -1153,8 +1153,10 @@ char* dd_load_text_ext(const struct dump_dir *dd, const char *name, unsigned fla if (!str_is_correct_filename(name)) { error_msg("Cannot load text. '%s' is not a valid file name", name); - if (!(flags & DD_LOAD_TEXT_RETURN_NULL_ON_FAILURE)) - xfunc_die(); + if ((flags & DD_LOAD_TEXT_RETURN_NULL_ON_FAILURE)) + return NULL; + + xfunc_die(); } /* Compat with old abrt dumps. Remove in abrt-2.1 */ -- 1.8.3.1