[Bug bzip2/25492] New: bzip2.c: ignoring return value of ‘fchown’

["noloader at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25492

            Bug ID: 25492
           Summary: bzip2.c: ignoring return value of ‘fchown’
           Product: bzip2
           Version: unspecified
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: bzip2
          Assignee: nobody at sourceware dot org
          Reporter: noloader at gmail dot com
                CC: bzip2-devel at sourceware dot org
  Target Milestone: ---

This warning makes me feel uneasy. I believe a similar issue in a different
function was exploited on Android to gain root privileges.

I don't have a specific exploit in mind. It might be a good idea to audit the
use of the function and ensure it is safe with and without root privileges.

gcc  -fpic -fPIC -Wall -D_FILE_OFFSET_BITS=64 -g2 -O2 -march=native -fPIC
-pthread -I. -L/usr/local/lib -Wl,-R,'$ORIGIN/../lib' -Wl,-R,/usr/local/lib
-Wl,--enable-new-dtags -o bzip2-shared bzip2.c libbz2.1.0.8.so
bzip2.c: In function ‘applySavedFileAttrToOutputFile’:
bzip2.c:1073:4: warning: ignoring return value of ‘fchown’, declared with
attribute warn_unused_result [-Wunused-result]
    (void) fchown ( fd, fileMetaInfo.st_uid, fileMetaInfo.st_gid );
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In the Android exploit, the return value of setuid() was not checked when root
attempted to drop privileges. Also see Android's Rage Against the Cage,
https://thesnkchrmr.wordpress.com/2011/03/24/rageagainstthecage/.

-- 
You are receiving this mail because:
You are on the CC list for the bug.