Re: temp file creation bug in diffutils 2.7

[Greg KH]

On Wed, Dec 27, 2000 at 03:03:50PM -0800, Greg KH wrote:
> In the diffutils 2.7 package, the sdiff program creates temp files in an
> insecure manner.  Below is a small patch that seems to fix the problem.
> This was found when building the latest version of Immunix Linux and we
> would like to release an updated package soon.

Bleah, that patch was pretty b0rken, my apologies to everyone involved.
Many thanks to Solar Designer who pointed it out to me.

Below should be a much better patch, that actually works :)

thanks,

greg k-h


--- sdiff.c.original    Tue Jan  2 09:37:16 2001
+++ sdiff.c     Tue Jan  2 09:45:40 2001
@@ -935,13 +935,20 @@
        case 'q':
          return 0;
        case 'e':
-         if (! tmpname && ! (tmpname = private_tempnam ()))
-           perror_fatal ("temporary file name");
-
-         tmpmade = 1;
-
          {
-           FILE *tmp = ck_fopen (tmpname, "w+");
+           int tfd;
+           FILE *tmp;
+           char tmpname[20];
+
+           strcpy (&tmpname[0], "/tmp/sdiffXXXXXX");
+           tfd = mkstemp(tmpname);
+           if (tfd == -1)
+             perror_fatal ("temporary file name");
+           tmp = fdopen (tfd, "w+");
+           if (tmp == NULL)
+             perror_fatal ("temporary file name");
+ 
+           tmpmade = 1;
 
            if (cmd1 == 'l' || cmd1 == 'b')
              lf_copy (left, lenl, tmp);


-- 
greg@(kroah|wirex).com
http://immunix.org/~greg