[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |pinskia at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I can't reproduce the crash any more but it should not be hard to fix.

The problem is in make-temp-file.c where we do:
static inline const char *
try_dir (const char *dir, const char *base)
{
  if (base != 0)
    return base;
  if (dir != 0
      && access (dir, R_OK | W_OK | X_OK) == 0)
    return dir;
  return 0;
}

But we don't check to see if the dir is actually a directory.

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Something like after the access check has passed:

#ifdef S_ISDIR
struct stat s;
if (stat(dir, &s) <0)
  return NULL;
if (!S_ISDIR (s.st_mode))
  return NULL;
#endif

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2021-Novembe
                   |                            |r/585591.html
           Keywords|                            |patch

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Patch submitted:
https://gcc.gnu.org/pipermail/gcc-patches/2021-November/585591.html

The only issue is hosts where S_ISDIR is not defined (I don't think there is
any left but it least it will just fail like it used to).

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Andrew Pinski <pinskia@gcc.gnu.org>:

https://gcc.gnu.org/g:68332ab7ec58a89660db82569c5f4c2251d59741

commit r12-5568-g68332ab7ec58a89660db82569c5f4c2251d59741
Author: Andrew Pinski <apinski@marvell.com>
Date:   Sat Nov 27 18:16:50 2021 -0800

    Fix PR 19089: Environment variable TMP may yield gcc: abort

    Even though I cannot reproduce the ICE any more, this is still
    a bug. We check already to see if we can access the directory
    but never check to see if the path is actually a directory.

    This adds the check and now we reject the file as not usable
    as a tmp directory.

    OK? Bootstrapped and tested on x86_64-linux-gnu with no regressions.

    libiberty/ChangeLog:

            * make-temp-file.c (try_dir): Check to see if the dir
            is actually a directory.

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed. Sorry it took so long in fixing this issue.

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2005-07-02 01:48 -------
Confirmed.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
           Keywords|                            |ice-on-invalid-code
   Last reconfirmed|0000-00-00 00:00:00         |2005-07-02 01:48:30
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-12-20 13:01 -------
In a way this is not a bug:
  fd = mkstemps (temp_filename, suffix_len);
  /* If mkstemps failed, then something bad is happening.  Maybe we should
     issue a message about a possible security attack in progress?  */
  if (fd == -1)
    abort ();
  /* Similarly if we can not close the file.  */
  if (close (fd))
    abort ();


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089

[Bug other/19089] Environment variable TMP may yield gcc: abort with internal error

[pinskia at gcc dot gnu dot org]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |other


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19089