Use secure_getenv(3) to improve security

This patch is in response to the following security vulnerabilities
(CVEs) reported to NVIDIA against libvdpau:

CVE-2015-5198
CVE-2015-5199
CVE-2015-5200

To address these CVEs, this patch:

- replaces all uses of getenv(3) with secure_getenv(3);
- uses secure_getenv(3) when available, with a fallback option;
- protects VDPAU_DRIVER against directory traversal by checking for '/'

On platforms where secure_getenv(3) is not available, the C preprocessor
will print a warning at compile time. Then, a preprocessor macro will
replace secure_getenv(3) with our getenv_wrapper(), which utilizes the check:

  getuid() == geteuid() && getgid() == getegid()

See getuid(2) and getgid(2) for further details.

Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>

1 files changed, 5 insertions, 3 deletions

diff --git a/trace/vdpau_trace.cpp b/trace/vdpau_trace.cpp
index 6e204b8..11e227c 100644
--- a/trace/vdpau_trace.cpp
+++ b/trace/vdpau_trace.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008-2009 NVIDIA, Corporation
+ * Copyright (c) 2008-2015 NVIDIA Corporation
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -31,6 +31,8 @@
 #include <string.h>
 #include <vdpau/vdpau_x11.h>
 
+#include "../src/util.h"
+
 #define _VDP_TRACE_ARSIZE(_x_) ((sizeof (_x_)) / (sizeof ((_x_)[0])))
 
 #if DEBUG
@@ -4795,13 +4797,13 @@ VdpStatus vdp_trace_device_create_x11(
     }
     else {
         _vdp_cap_data.level = 0;
-        char const * vdpau_trace = getenv("VDPAU_TRACE");
+        char const * vdpau_trace = secure_getenv("VDPAU_TRACE");
         if (vdpau_trace) {
             _vdp_cap_data.level = atoi(vdpau_trace);
         }
 
         _vdp_cap_data.fp = 0;
-        char const * vdpau_trace_file = getenv("VDPAU_TRACE_FILE");
+        char const * vdpau_trace_file = secure_getenv("VDPAU_TRACE_FILE");
         if (vdpau_trace_file && strlen(vdpau_trace_file)) {
             if (vdpau_trace_file[0] == '&') {
                 int fd = atoi(&vdpau_trace_file[1]);