Fix mutt_unlink race condition for systems without O_NOFOLLOW.

Noted by Jarno Huuskonen <Jarno.Huuskonen@uku.fi>.

diff --git a/lib.c b/lib.c
index 19473c97c12b60dba5594905fdf2220583ef1ec2..f3cb073b9e8d93e3b0417ee8b3fad6d663e8f104 100644 (file)
--- a/lib.c
+++ b/lib.c
@@ -184,7 +184,7 @@ void mutt_unlink (const char *s)
   int fd;
   int flags;
   FILE *f;
-  struct stat sb;
+  struct stat sb, sb2;
   char buf[2048];
 
   /* Defend against symlink attacks */
@@ -195,10 +195,18 @@ void mutt_unlink (const char *s)
   flags = O_RDWR;
 #endif
   
-  if (stat (s, &sb) == 0)
+  if (lstat (s, &sb) == 0 && S_ISREG(sb.st_mode))
   {
     if ((fd = open (s, flags)) < 0)
       return;
+    
+    if ((fstat (fd, &sb2) != 0) || !S_ISREG (sb2.st_mode) 
+       || (sb.st_dev != sb2.st_dev) || (sb.st_ino != sb2.st_ino))
+    {
+      close (fd);
+      return;
+    }
+    
     if ((f = fdopen (fd, "r+")))
     {
       unlink (s);