Hi all,

As the packager of Lazarus in Fedora, I get notifications if someone files a bug in Fedora's bug-tracker.

Now someone added a bug-report with a security issue: https://bugzilla.redhat.com/show_bug.cgi?id=460642

And indeed, if someone add a symlink like 'ln -s /tmp/fpc_patchdir /etc' and thereafter someone with root-permissions runs the check_fpc_dependencies.sh script with th following code in it he won't be happy:

89 TmpDir=/tmp/fpc_patchdir
90 if [ "$WithTempDir" = "yes" ]; then
91 if [ -d $TmpDir ]; then
92 rm -rf $TmpDir/*
93 rm -r $TmpDir
94 fi

How can we fix this?

Joost.

I replaced it with
rm -rf $TmpDir

Mattias

Somebody reported the same (or similar) issues in the debian bug tracker.

Maybe the best solution is not to package these scripts in rpm/debs, so that they don't enter the dangerous wild where people are running scripts with root permissions and add symlinks in the tmp directory.

Vincent

You should create a temporary name or check and see where the symlink follows before executing/removing it. So if it does not point for the right direction, you just exit with an error.

Ido

Just some ideas on the topic. IMHO the tmp-dir should have a random, or pseudo-random element to it, and the current script should not (at least not without asking) delete a tmp-dir.

A random element (such as the PID ) would solve issues if 2 different users run the script simultaneously (e.g if both install a local copy of lazarus into their home dirs). In terms of security it would make any attack on the tmp dirs harder.

This example also shows why existing temp dirs should not be deleted (without asking). They could still be in use. I have not checked the current script (and neither am I an expert on shell scripting), but I assume that the script removes it temp script on exit? And "trap" could be used to make sure this happens even if aborted?

Regards
Martin

Op vrijdag 29-08-2008 om 15:53 uur [tijdzone +0200], schreef Mattias Gaertner:

Read the link, this was only one example, but there are more. And your solution works for the hack in my example, but I doubt it is entirely safe.

Joost.

You are right.
The script was not intended to run on malicious multi user systems. It was written to create a rpm and to easily debug the rpm building. Using the tmp directory is per se a security risk. It would be better to use the home directory by default. But this does not work on some systems.
The best ad hoc solution is already mentioned in the link: don't add the scripts to the rpm.

Mattias

Dear sirs:

I need to convert a Float to a number with two decimal places in a Lazarus Project for Windows..

I am thinking to use the following procedure:

procedure FloatToDecimal(var DecVal: TFloatRec; const Value; ValueType:
TFloatValue; Precision, Decimals: Integer);

but I dont know what to write in some of the arguments.

Thanks in advance for your help,

yours truly,

Ing. H?ctor F. Fiandor

Procedure FloatToDecimal(Out Result: TFloatRec; Value: Extended; Precision,
Decimals : integer);

The Precision, and Decimals work together to ensure the rounding etc.

So lets say you want to have float to decimal, and have 5 "digits"... And you do it on a value of 2 then the result will be
2.00000

If you only want a precision 2 but want decimals 5, and run it for pi, you will get
3.14000

So general rule is to have your precision higher than your digits, and you'll have good "rounding".

Hmmm... My test program shows some funnies:

procedure TForm1.FormDblClick ( Sender : TObject ) ;
var t : TFloatRec;
begin
  FloatToDecimal(t,pi,5,3);
  ShowMessage(inttostr(t.Exponent)+'.'+t.Digits);
end;

Shows 3.1432 -- not 3.143 as expected...

FloatToDecimal(t,pi,2,6);
Showed, 3.14

(not 3.140000) as I expected...

On Sat, Aug 30, 2008 at 4:19 AM, H?ctor Fiandor Rosario <

diar Mr. Reenen Laurie:

thanks very much for your answer.

really, I think that my problem was in the TFloatRec. I see that you declare as var. I will try your suggestions.

yours,

Ing. H?ctor F. Fiandor