Skip to content

head: Fixed TOCTOU bug in checking of metadata#12439

Open
max-amb wants to merge 2 commits into
uutils:mainfrom
max-amb:fix_head_TOCTOU
Open

head: Fixed TOCTOU bug in checking of metadata#12439
max-amb wants to merge 2 commits into
uutils:mainfrom
max-amb:fix_head_TOCTOU

Conversation

@max-amb
Copy link
Copy Markdown
Contributor

@max-amb max-amb commented May 22, 2026

Fixes #11972.

Doesn't look exploitable in any degree but lack of TOCTOU is perhaps nice to have.

Not sure if a closure was the best way to do print_header, very open to alternative approaches.

@github-actions
Copy link
Copy Markdown

GNU testsuite comparison:

Skipping an intermittent issue tests/tail/symlink (passes in this run but fails in the 'main' branch)
Note: The gnu test tests/printf/printf-surprise is now being skipped but was previously passing.

@oech3
Copy link
Copy Markdown
Contributor

oech3 commented May 23, 2026

This should be catched at 1st read. But it is currently difficult since we don't distinct read error and write error #12265 .

@max-amb
Copy link
Copy Markdown
Contributor Author

max-amb commented May 23, 2026

I don't see how the write error proposed in the PR would be incorporated? We don't have a specific metadata access error so does that need to be added? Otherwise it can fail at two different points with the same error.

@oech3
Copy link
Copy Markdown
Contributor

oech3 commented May 23, 2026

@oech3
Copy link
Copy Markdown
Contributor

oech3 commented May 23, 2026

We can just remove .is_dir()after read stated catching ErrorKind::IsADirectory.

@max-amb
Copy link
Copy Markdown
Contributor Author

max-amb commented May 23, 2026

Oh I see. To confirm, once ReadError is added we can handle directories while checking file metadata with map error?

@oech3
Copy link
Copy Markdown
Contributor

oech3 commented May 23, 2026

I think we can just do somethin like writeln!(stderr(), "{e}"); (without checking metadata).

@max-amb
Copy link
Copy Markdown
Contributor Author

max-amb commented May 23, 2026

How would this look with all of the print_header() calls required, because we need to print the header only if we have perms to open the file/header. So wouldn't we still need to check if we can get metadata before print_header().

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

head: potentially TOCTOU race with .is_dir()

2 participants