开发者

mkdir() and "Time of Check, Time of Use" vulnerabilities

Is there a secure altern开发者_如何学JAVAative to mkdir() for C? I am examining some code and notice it is using calls to mkdir(). From what I have read on the US-CERT Secure Coding site, use of that function leaves it vulnerable to "Time of Check, Time of Use" (TOCTOU).

Edit

From the miniunz.c source for zlib

int mymkdir(dirname)
    const char* dirname;
{
    int ret=0;
#ifdef WIN32
    ret = mkdir(dirname);
#else
#ifdef unix
    ret = mkdir (dirname,0775);
#endif
#endif
    return ret;
}

The mkdirabove is what I am referring to.


Your question is a little vague; a reference to the US-CERT document and some sample code would be nice.

Nevertheless, I bet the answer is mkdirat().


mkdir() is only TOCTOU - Time of Check, Time of Use when it's preceded by a check to see if the directory exists.

The usage above, in your example, is ok if the calling code does the right thing. Check Zack's comment.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜