From d0899afa3a5823cfd4260292801bfcf8227a6214 Mon Sep 17 00:00:00 2001
From: Kris Kennaway <kris@FreeBSD.org>
Date: Sat, 12 Oct 2002 20:32:03 +0000
Subject: Disallow libdialog to be used in setugid applications; it is chock
 full of buffer overflows.

MFC after:      3 days
---
 gnu/lib/libdialog/kernel.c | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'gnu')

diff --git a/gnu/lib/libdialog/kernel.c b/gnu/lib/libdialog/kernel.c
index c30e478457f8a..d81ebfeee47ee 100644
--- a/gnu/lib/libdialog/kernel.c
+++ b/gnu/lib/libdialog/kernel.c
@@ -75,11 +75,14 @@
  *	         prove 'interesting' to say the least :-)
  *             Added radiolist option
  *	     - Version 0.4 released.
+ *
+ * $FreeBSD$
  */
 
 #define __DIALOG_MAIN__
 
 #include <dialog.h>
+#include <err.h>
 #include "dialog.priv.h"
 #ifdef HAVE_NCURSES
 #include "colors.h"
@@ -98,6 +101,11 @@ int DialogInputAttrs;
  */
 void init_dialog(void)
 {
+
+  if (issetugid()) {
+	errx(1, "libdialog is unsafe to use in setugid applications");
+  }
+
 #if defined(LOCALE)
   (void) setlocale(LC_ALL, "");
 #endif
-- 
cgit v1.3