sync a bit w/ Net's solution to CERT-96.08.

1 files changed, 24 insertions, 13 deletions

diff --git a/usr.sbin/rpc.pcnfsd/pcnfsd_print.c b/usr.sbin/rpc.pcnfsd/pcnfsd_print.c
index 4b3394cebba..783bc7ad5b5 100644
--- a/usr.sbin/rpc.pcnfsd/pcnfsd_print.c
+++ b/usr.sbin/rpc.pcnfsd/pcnfsd_print.c
@@ -149,14 +149,21 @@ pr_list curr;
 	return(0);
 }
 
+/*
+ * get pathname of current directory and return to client
+ *
+ * Note: This runs as root on behalf of a client request.
+ * As described in CERT advisory CA-96.08, be careful about
+ * doing a chmod on something that could be a symlink...
+ */
 pirstat pr_init(sys, pr, sp)
 char *sys;
 char *pr;
 char**sp;
 {
-int    dir_mode = 0777;
-int rc;
-mode_t oldmask;
+	int    dir_mode = 0777;
+	int rc;
+	mode_t oldmask;
 
 	*sp = &pathname[0];
 	pathname[0] = '\0';
@@ -164,28 +171,32 @@ mode_t oldmask;
 	if(suspicious(sys) || suspicious(pr))
 		return(PI_RES_FAIL);
 
-	/* get pathname of current directory and return to client */
-
+	/*
+	 * Create the client spool directory if needed.
+	 * Just do the mkdir call and ignore EEXIST.
+	 * Mode of client directory should be 777.
+	 */
 	(void)sprintf(pathname,"%s/%s",sp_name, sys);
 	oldmask = umask(0);
-	(void)mkdir(sp_name, dir_mode);	/* ignore the return code */
 	rc = mkdir(pathname, dir_mode);	/* DON'T ignore this return code */
 	umask(oldmask);
+
 	if((rc < 0 && errno != EEXIST) ||
 	   (stat(pathname, &statbuf) != 0) ||
 	   !(statbuf.st_mode & S_IFDIR)) {
-	   (void)sprintf(tempstr,
-		         "rpc.pcnfsd: unable to set up spool directory %s\n",
+		(void)sprintf(tempstr,
+		    "rpc.pcnfsd: unable to set up spool directory %s\n",
 		 	  pathname);
-            msg_out(tempstr);
+		msg_out(tempstr);
 	    pathname[0] = '\0';	/* null to tell client bad vibes */
 	    return(PI_RES_FAIL);
-	    }
- 	if (!valid_pr(pr)) 
-           {
+	}
+
+	/* OK, we have a spool directory. */
+ 	if (!valid_pr(pr)) {
 	    pathname[0] = '\0';	/* null to tell client bad vibes */
 	    return(PI_RES_NO_SUCH_PRINTER);
-	    } 
+	} 
 	return(PI_RES_OK);
 
 }