[Emacs-diffs] emacs-24 r117087: * browse-url.el (browse-url-mosaic): Be careful when writing /tmp/Mosaic.PID.

[Glenn Morris]

------------------------------------------------------------
revno: 117087
revision-id: address@hidden
parent: address@hidden
fixes bug: http://debbugs.gnu.org/17428
committer: Glenn Morris <address@hidden>
branch nick: emacs-24
timestamp: Thu 2014-05-08 14:10:36 -0400
message:
  * browse-url.el (browse-url-mosaic): Be careful when writing /tmp/Mosaic.PID.
  This is CVE-2014-3423.
modified:
  lisp/ChangeLog                 changelog-20091113204419-o5vbwnq5f7feedwu-1432
  lisp/net/browse-url.el         
browseurl.el-20091113204419-o5vbwnq5f7feedwu-1785

=== modified file 'lisp/ChangeLog'
--- a/lisp/ChangeLog    2014-05-08 01:46:15 +0000
+++ b/lisp/ChangeLog    2014-05-08 18:10:36 +0000
@@ -1,3 +1,9 @@
+2014-05-08  Glenn Morris  <address@hidden>
+
+       * net/browse-url.el (browse-url-mosaic):
+       Be careful when writing /tmp/Mosaic.PID.  (Bug#17428)
+       This is CVE-2014-3423.
+
 2014-05-08  Stefan Monnier  <address@hidden>
 
        * xt-mouse.el: Drop spurious/oddly shaped events (bug#17378).

=== modified file 'lisp/net/browse-url.el'
--- a/lisp/net/browse-url.el    2014-05-06 03:55:54 +0000
+++ b/lisp/net/browse-url.el    2014-05-08 18:10:36 +0000
@@ -1333,31 +1333,26 @@
   (let ((pidfile (expand-file-name browse-url-mosaic-pidfile))
        pid)
     (if (file-readable-p pidfile)
-       (save-excursion
-         (find-file pidfile)
-         (goto-char (point-min))
-         (setq pid (read (current-buffer)))
-         (kill-buffer nil)))
-    (if (and pid (zerop (signal-process pid 0))) ; Mosaic running
-       (save-excursion
-         ;; This is a predictable temp-file name, which is bad,
-         ;; but it is what Mosaic uses/used.
-         ;; So it's not Emacs's problem.  http://bugs.debian.org/747100
-         (find-file (format "/tmp/Mosaic.%d" pid))
-         (erase-buffer)
-         (insert (if (browse-url-maybe-new-window new-window)
-                     "newwin\n"
-                   "goto\n")
-                 url "\n")
-         (save-buffer)
-         (kill-buffer nil)
+        (with-temp-buffer
+          (insert-file-contents pidfile)
+         (setq pid (read (current-buffer)))))
+    (if (and (integerp pid) (zerop (signal-process pid 0))) ; Mosaic running
+        (progn
+          (with-temp-buffer
+            (insert (if (browse-url-maybe-new-window new-window)
+                        "newwin\n"
+                      "goto\n")
+                    url "\n")
+            (if (file-exists-p (setq pidfile (format "/tmp/Mosaic.%d" pid)))
+                (delete-file pidfile))
+            ;; http://debbugs.gnu.org/17428.  Use O_EXCL.
+            (write-region nil nil pidfile nil 'silent nil 'excl))
          ;; Send signal SIGUSR to Mosaic
          (message "Signaling Mosaic...")
          (signal-process pid 'SIGUSR1)
          ;; Or you could try:
          ;; (call-process "kill" nil 0 nil "-USR1" (int-to-string pid))
-         (message "Signaling Mosaic...done")
-         )
+         (message "Signaling Mosaic...done"))
       ;; Mosaic not running - start it
       (message "Starting %s..." browse-url-mosaic-program)
       (apply 'start-process "xmosaic" nil browse-url-mosaic-program