On 6/30/24 07:00, Ma Ke wrote:
The open() function returns -1 on error. openat() and open() initialize
'from' and 'to', and only 'from' validated with 'if' statement. If the
initialization of variable 'to' fails, we should better check the value
of 'to' and close 'from' to avoid possible file leak. Improve the checking
of 'from' additionally.
Fixes: 32ae976ed3b5 ("selftests/capabilities: Add tests for capability evolution")
Signed-off-by: Ma Ke <make24@xxxxxxxxxxx>
---
Changes in v3:
- Thank you for your interest in our vulnerability detection method. We
extract vulnerability characteristics from a known vulnerability and match
the same characteristics in the project code. As our work is still in
progress, we are not able to disclose it at this time. Appreciate your
understanding, we could better focus on the potential vulnerability itself.
Reference link: https://lore.kernel.org/all/20240510003424.2016914-1-samasth.norway.ananda@xxxxxxxxxx/
Sorry it is a NACK - without more details on the tool and warning,
I can't accept this patch.
thanks,
-- Shuah
