texinfo (Re: Owl packages with dangerous "tmp" functions)

[Solar Designer]

Hi,

Quoting my own post to vendor-sec,

> texinfo (texindex) I've fixed, by creating a temporary directory
> and letting texindex play there (the code relies on ability to not
> store temporary file names and re-generate them by number).  I'll
> post the patch which fixes this and a bug which caused this entire
> feature to not work (it looks like noone has ever tested it). :-)

I am now attaching the patch against texinfo-4.0.

That other bug I mentioned is this:

-      sort_in_core (&tempfiles[i], MAX_IN_CORE_SORT, newtemp);
+      sort_in_core (tempfiles[i], MAX_IN_CORE_SORT, newtemp);

-- 
/sd

--- texinfo-4.0/util/texindex.c.orig    Wed Jan  3 09:37:01 2001
+++ texinfo-4.0/util/texindex.c Wed Jan  3 10:50:52 2001
@@ -19,6 +19,7 @@
 
 #include "system.h"
 #include <getopt.h>
+#include <stdlib.h>
 
 static char *program_name = "texindex";
 
@@ -36,8 +37,6 @@
 #define memset(ptr, ignore, count) bzero (ptr, count)
 #endif
 
-char *mktemp ();
-
 #if !defined (SEEK_SET)
 #  define SEEK_SET 0
 #  define SEEK_CUR 1
@@ -96,9 +95,6 @@
 /* Directory to use for temporary files.  On Unix, it ends with a slash.  */
 char *tempdir;
 
-/* Start of filename to use for temporary files.  */
-char *tempbase;
-
 /* Number of last temporary file.  */
 int tempcount;
 
@@ -137,6 +133,7 @@
 void *xmalloc (), *xrealloc ();
 char *concat ();
 void flush_tempfiles ();
+void flush_tempfiles_atexit ();
 
 #define MAX_IN_CORE_SORT 500000
 
@@ -180,8 +177,6 @@
 
   decode_command (argc, argv);
 
-  tempbase = mktemp (concat ("txiXXXXXX", "", ""));
-
   /* Process input files completely, one by one.  */
 
   for (i = 0; i < num_infiles; i++)
@@ -301,6 +296,8 @@
   int arg_index = 1;
   char **ip;
   char **op;
+  int retries;
+  char *dot;
 
   /* Store default values into parameter variables. */
 
@@ -314,8 +311,24 @@
   else
     tempdir = concat (tempdir, "/", "");
 
+  tempdir = concat(tempdir, "txi.XXXXXX", "");
+  retries = 0x1000;
+  do
+    {
+      if (mktemp (tempdir) == NULL)
+        fatal ("mktemp: %s: %s", tempdir, strerror (errno));
+      if (mkdir (tempdir, 0700) == 0) break;
+      if (errno != EEXIST || !--retries)
+        fatal ("mkdir: %s: %s", tempdir, strerror (errno));
+      if ((dot = strrchr (tempdir, '.')))
+        strcpy (dot, ".XXXXXX");
+    }
+  while (1);
+
   keep_tempfiles = 0;
 
+  atexit(flush_tempfiles_atexit);
+
   /* Allocate ARGC input files, which must be enough.  */
 
   infiles = (char **) xmalloc (argc * sizeof (char *));
@@ -386,8 +399,8 @@
      int count;
 {
   char tempsuffix[10];
-  sprintf (tempsuffix, ".%d", count);
-  return concat (tempdir, tempbase, tempsuffix);
+  sprintf (tempsuffix, "/%d", count);
+  return concat (tempdir, tempsuffix, "");
 }
 
 /* Delete all temporary files up to TO_COUNT. */
@@ -400,6 +413,13 @@
     return;
   while (last_deleted_tempcount < to_count)
     unlink (maketempname (++last_deleted_tempcount));
+  rmdir (tempdir);
+}
+
+void
+flush_tempfiles_atexit (void)
+{
+  flush_tempfiles (tempcount);
 }
 
 
@@ -940,7 +960,7 @@
   for (i = 0; i < ntemps; i++)
     {
       char *newtemp = maketempname (++tempcount);
-      sort_in_core (&tempfiles[i], MAX_IN_CORE_SORT, newtemp);
+      sort_in_core (tempfiles[i], MAX_IN_CORE_SORT, newtemp);
       if (!keep_tempfiles)
         unlink (tempfiles[i]);
       tempfiles[i] = newtemp;