From 9f80b23edba1eb6dc40b63adb35b30c1b7a0e325 Mon Sep 17 00:00:00 2001 From: Mingjie Shen Date: Tue, 5 Mar 2024 19:10:06 -0500 Subject: [PATCH] test/pkcs7: Fix TOCTOU race condition Separately checking the state of a file before operating on it may allow an attacker to modify the file between the two operations. (CWE-367) Signed-off-by: Mingjie Shen --- tests/suites/test_suite_pkcs7.function | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_pkcs7.function b/tests/suites/test_suite_pkcs7.function index 4c8bf233ef..52112a083d 100644 --- a/tests/suites/test_suite_pkcs7.function +++ b/tests/suites/test_suite_pkcs7.function @@ -121,12 +121,12 @@ void pkcs7_verify(char *pkcs7_file, TEST_EQUAL(res, 0); } - res = stat(filetobesigned, &st); - TEST_EQUAL(res, 0); - file = fopen(filetobesigned, "rb"); TEST_ASSERT(file != NULL); + res = fstat(fileno(file), &st); + TEST_EQUAL(res, 0); + datalen = st.st_size; /* Special-case for zero-length input so that data will be non-NULL */ TEST_CALLOC(data, datalen == 0 ? 1 : datalen);