compiz team mailing list archive

Thread
Date

[Bug 1101608] Re: Coverity TOCTOU - CID 12544 - compizconfig/libcompizconfig/src/compiz.cpp - in function: loadOptionsStringExtensionsFromXML(_CCSPlugin , void , stat ) - Calling function "stat(char const , stat )" to perform check on "pPrivate->xmlFile" in line 3174, 3 lines later calling function "fopen(char const , char const *)" that uses "pPrivate->xmlFile" after a check function. This can cause a time-of-check, time-of-use race condition.

To: compiz@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1101608@xxxxxxxxxxxxxxxxxx>
Date: Thu, 18 Dec 2014 13:46:45 -0000
Reply-to: Bug 1101608 <1101608@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

This bug was fixed in the package compiz -
1:0.9.12.0+15.04.20141210.2-0ubuntu1

---------------
compiz (1:0.9.12.0+15.04.20141210.2-0ubuntu1) vivid; urgency=medium

  [ James Jones ]
  * Added support for GL_EXT_x11_sync_object OpenGL extension for Nvidia
    based GPUs to avoid screen refresh issues. (LP: #269904)

  [ Kyle Brenneman ]
  * Added support for GL_EXT_x11_sync_object OpenGL extension for Nvidia
    based GPUs to avoid screen refresh issues. (LP: #269904)

  [ Viktor A. Danilov ]
  * Added support for GL_EXT_x11_sync_object OpenGL extension for Nvidia
    based GPUs to avoid screen refresh issues. (LP: #269904)

  [ Chris Townsend ]
  * Added support for GL_EXT_x11_sync_object OpenGL extension for Nvidia
    based GPUs to avoid screen refresh issues. (LP: #269904)

  [ Stephen M. Webb ]
  * Added support for GL_EXT_x11_sync_object OpenGL extension for Nvidia
    based GPUs to avoid screen refresh issues. (LP: #269904)
  * libdecoration/CMakeLists.txt: use correct variable for link
    directories (LP: #1392715)
  * Switcher Plugin: renamed a local variable so it does not hide a
    function parameter. (LP: #1101585)
  * added support for multi-arch installations (LP: #1395105, #959282)
  * libcompizconfig: reorder stat() and open() calls to eliminate a race
    condition (LP: #1101608)
  * dodge plugin: avoid potential null pointer dereferences (LP:
    #1101554)
  * PrivateScreen unit tests: added additional assertions to verify the
    tests are run in an expected state (LP: #1101413)

  [ Ubuntu daily release ]
  * New rebuild forced

  [ Brandon Schaefer ]
  * Rev 3891 change caused 2 known regressions. (Could be more).
    Reverting. (LP: #1398512, #1393020)
 -- Ubuntu daily release <ps-jenkins@xxxxxxxxxxxxxxxxxxx>   Wed, 10 Dec 2014 19:52:06 +0000

** Changed in: compiz (Ubuntu)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of compiz
packagers, which is subscribed to compiz in Ubuntu.
https://bugs.launchpad.net/bugs/1101608

Title:
  Coverity TOCTOU - CID 12544 -
  compizconfig/libcompizconfig/src/compiz.cpp - in function:
  loadOptionsStringExtensionsFromXML(_CCSPlugin *, void *, stat *) -
  Calling function "stat(char const *, stat *)" to perform check on
  "pPrivate->xmlFile" in line 3174, 3 lines later calling function
  "fopen(char const *, char const *)" that uses "pPrivate->xmlFile"
  after a check function. This can cause a time-of-check, time-of-use
  race condition.

To manage notifications about this bug go to:
https://bugs.launchpad.net/compiz/+bug/1101608/+subscriptions