InfoSect's Month of Pointless Bugs (#10)

Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #10

ltris game never drops privs and writes to files. Similar to http://blog.infosectcbr.com.au/2018/02/infosects-month-of-pointless-bugs-5.html and http://blog.infosectcbr.com.au/2018/02/infosects-month-of-pointless-bugs-7.html

void config_check_dir() { #ifdef DISABLE_INSTALL sprintf( config.dir_name, "." ); #else snprintf( config.dir_name, sizeof(config.dir_name)-1, "%s/%s", getenv( "HOME" ), CONFIG_DIR_NAME ); #endif if ( opendir( config.dir_name ) == 0 ) { fprintf( stderr, "couldn't find/open config directory '%s'\n", config.dir_name ); fprintf( stderr, "attempting to create it... " ); #ifdef WIN32 mkdir( config.dir_name ); #else mkdir( config.dir_name, S_IRWXU ); #endif if ( opendir( config.dir_name ) == 0 ) fprintf( stderr, "failed\n" ); else fprintf( stderr, "ok\n" ); } }