Use mkstemp in netperf code to open the debug log in order to avoid

a symlink vulnerability. This fixes CVE-2007-1444.

3 files changed, 80 insertions, 0 deletions

diff --git a/benchmarks/netperf/patches/patch-ah b/benchmarks/netperf/patches/patch-ah
new file mode 100644
index 00000000000..6f030e4ae66
--- /dev/null
+++ b/benchmarks/netperf/patches/patch-ah
@@ -0,0 +1,12 @@
+$NetBSD: patch-ah,v 1.1 2008/05/12 15:49:30 tonnerre Exp $
+
+--- netlib.h.orig	2004-09-21 23:33:40.000000000 +0200
++++ netlib.h
+@@ -343,6 +343,7 @@ extern  int     lib_num_loc_cpus;
+ extern  SOCKET  server_sock;
+ extern  int     times_up;
+ extern  FILE    *where;
++extern	int	fd;
+ extern  int     loops_per_msec;
+ extern  float   lib_local_per_cpu_util[];
+   
diff --git a/benchmarks/netperf/patches/patch-ai b/benchmarks/netperf/patches/patch-ai
new file mode 100644
index 00000000000..48e2f33f305
--- /dev/null
+++ b/benchmarks/netperf/patches/patch-ai
@@ -0,0 +1,56 @@
+$NetBSD: patch-ai,v 1.1 2008/05/12 15:49:30 tonnerre Exp $
+
+--- netserver.c.orig	2004-09-21 23:33:40.000000000 +0200
++++ netserver.c
+@@ -138,6 +138,9 @@ FILE	*afp;
+ short	listen_port_num;
+ extern	char	*optarg;
+ extern	int	optind, opterr;
++#ifndef WIN32
++char debuglog[] = "/tmp/netperf.debugXXXXXX";
++#endif
+ 
+ #ifndef WIN32
+ #define SERVER_ARGS "dn:p:v:46"
+@@ -181,8 +184,14 @@ process_requests()
+       netperf_response.content.response_type = DEBUG_OK;
+       send_response();
+ 	  //+*+SAF why???
+-	  if (!debug) 
++	  if (!debug)
++	  {
+ 	      fclose(where);
++#ifndef WIN32
++	      unlink(debuglog);
++	      close(fd);
++#endif
++	  }
+       break;
+       
+     case CPU_CALIBRATE:
+@@ -730,7 +739,13 @@ struct sockaddr name;
+ 
+ /*  unlink(DEBUG_LOG_FILE); */
+ #ifndef WIN32
+-  if ((where = fopen(DEBUG_LOG_FILE, "w")) == NULL) {
++  if ((fd = mkstemp(debuglog)) == -1 || (where = fdopen(fd, "w+")) == NULL)
++  {
++    if (fd != -1)
++    {
++      unlink(debuglog);
++      close(fd);
++    }
+     perror("netserver: debug file");
+     exit(1);
+   }
+@@ -761,10 +776,6 @@ struct sockaddr name;
+   }
+ #endif
+  
+-#ifndef WIN32 
+-  chmod(DEBUG_LOG_FILE,0644);
+-#endif
+-  
+ #if WIN32
+   if (child) {
+ 	  server_sock = (SOCKET)GetStdHandle(STD_INPUT_HANDLE);
diff --git a/benchmarks/netperf/patches/patch-ak b/benchmarks/netperf/patches/patch-ak
new file mode 100644
index 00000000000..865f2ac0022
--- /dev/null
+++ b/benchmarks/netperf/patches/patch-ak
@@ -0,0 +1,12 @@
+$NetBSD: patch-ak,v 1.1 2008/05/12 15:49:30 tonnerre Exp $
+
+--- netlib.c.orig	2004-09-21 23:33:40.000000000 +0200
++++ netlib.c
+@@ -422,6 +422,7 @@ union   netperf_request_struct  netperf_
+ union   netperf_response_struct netperf_response;
+ 
+ FILE    *where;
++int	fd = -1;
+ 
+ char    libfmt = 'm';
+