gnu/packages/patches/lxterminal-CVE-2016-10369.patch

   1 Fix CVE-2016-10369:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10369
   4
   5 Patch copied from upstream source repository:
   6
   7 https://git.lxde.org/gitweb/?p=lxde/lxterminal.git;a=commit;h=f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648
   8
   9 From f99163c6ff8b2f57c5f37b1ce5d62cf7450d4648 Mon Sep 17 00:00:00 2001
  10 From: Yao Wei <mwei@lxde.org>
  11 Date: Mon, 8 May 2017 00:47:55 +0800
  12 Subject: [PATCH] fix: use g_get_user_runtime_dir for socket directory
  13
  14 This bug is pointed out by stackexchange user that putting socket file in
  15 /tmp is a potential risk. Putting the socket dir in user directory could
  16 mitigate the risk.
  17 ---
  18  src/unixsocket.c | 3 ++-
  19  1 file changed, 2 insertions(+), 1 deletion(-)
  20
  21 diff --git a/src/unixsocket.c b/src/unixsocket.c
  22 index 4c660ac..f88284c 100644
  23 --- a/src/unixsocket.c
  24 +++ b/src/unixsocket.c
  25 @@ -140,7 +140,8 @@ gboolean lxterminal_socket_initialize(LXTermWindow * lxtermwin, gint argc, gchar
  26       * This function returns TRUE if this process should keep running and FALSE if it should exit. */
  27
  28      /* Formulate the path for the Unix domain socket. */
  29 -    gchar * socket_path = g_strdup_printf("/tmp/.lxterminal-socket%s-%s", gdk_display_get_name(gdk_display_get_default()), g_get_user_name());
  30 +    gchar * socket_path = g_strdup_printf("%s/.lxterminal-socket-%s", g_get_user_runtime_dir(), gdk_display_get_name(gdk_display_get_default()));
  31 +    printf("%s\n", socket_path);
  32
  33      /* Create socket. */
  34      int fd = socket(PF_UNIX, SOCK_STREAM, 0);
  35 --
  36 2.1.4
  37