On 2 February 2011 08:13, Mladen Gogala <mladen.gogala@vmsinfo.com> wrote:
> Andrej wrote:
>>
>>
>> I have no idea what esqlc is, but I'll hazard a guess that it by
>> default includes
>> something that actually defines FILE. FILE isn't defined in stdio.h
>> or stdlib.h,
>> for that matter, so I'm not really surprised that it won't compile.
>>
>
> Actually, it is defined in stdio.h:
>
> cat ttt.c
>
> #include <stdio.h>
> main() {
> FILE *fp=fopen("/tmp/aaa","w+");
> fprintf(fp,"Hello World!\n");
> }
> [mgogala@medo tmp]$ gcc ttt.c -o ttt
> [mgogala@medo tmp]$
>
> No complaints. It even executes. This program, of course, is bug free.
I'll have to object to the "bug free" comment :)
You don't check if the fopen() call succeeded.
Also, if this code is run as root (e.g. from a cron job) then a local
user could convince it to overwrite any arbitrary file just by
creating a symlink in /tmp pointing to the file to overwrite (assuming
/tmp/aaa doesn't exist before the malicious user creates the symlink,
of course.)
--
Michael Wood <esiotrot@gmail.com>