Re: [Bug-wget] Wget - acess list bypass / race condition PoC

[Giuseppe Scrivano]

Hi Eli,

Eli Zaretskii <address@hidden> writes:

>> From: Giuseppe Scrivano <address@hidden>
>> Date: Sun, 21 Aug 2016 15:26:58 +0200
>> Cc: "address@hidden" <address@hidden>,
>>      Dawid Golunski <address@hidden>,
>>      "address@hidden" <address@hidden>
>> 
>>  #else /* def __VMS */
>> -          *fp = fopen (hs->local_file, "wb");
>> +          if (opt.delete_after
>> +            || opt.spider /* opt.recursive is implicitely true */
>> +            || !acceptable (hs->local_file))
>> +            {
>> +              *fp = fdopen (open (hs->local_file, O_CREAT | O_TRUNC | 
>> O_WRONLY, S_IRUSR | S_IWUSR), "wb");
>> +            }
>
> For this to work on MS-Windows, the 'open' call should use O_BINARY,
> in addition to the other flags.  Otherwise, the "b" in "wb" of
> 'fdopen' will be ignored by the MS runtime.

thanks for the review, I am going to amend it to the patch.

Giuseppe