Bug#425254: wdiff: unsafe use of tmpnam: symlink attack

[Santiago Vila]

On Tue, 17 Jun 2008, Nico Golde wrote:

> Please also check the return value of mkstemp, it may fail.

Ok. I will use this instead. I've checked how it behaves by doing
"chmod a-w /tmp" and it seems to work.

diff -ru wdiff-0.5.original/wdiff.c wdiff-0.5/wdiff.c
--- wdiff-0.5.original/wdiff.c  2008-06-17 19:14:37.000000000 +0200
+++ wdiff-0.5/wdiff.c   2008-06-17 19:16:30.000000000 +0200
@@ -560,6 +560,7 @@
 split_file_into_words (SIDE *side)
 {
   struct stat stat_buffer;     /* for checking if file is directory */
+  int fd;               /* for file descriptors returned by mkstemp */
 
   /* Open files.  */
 
@@ -571,8 +572,10 @@
         this temporary local file.  Once done, prepare it for reading.
         We do not need the file name itself anymore.  */
 
-      tmpnam (side->temp_name);
-      side->file = fopen (side->temp_name, "w+");
+      strcpy(side->temp_name, "/tmp/wdiff.XXXXXX");
+      if ((fd = mkstemp(side->temp_name)) == -1)
+       error (EXIT_OTHER_REASON, errno, side->temp_name);
+      side->file = fdopen(fd, "w+");
       if (side->file == NULL)
        error (EXIT_OTHER_REASON, errno, side->temp_name);
       if (unlink (side->temp_name) != 0)
@@ -598,8 +601,10 @@
   side->character = getc (side->file);
   side->position = 0;
 
-  tmpnam (side->temp_name);
-  side->temp_file = fopen (side->temp_name, "w");
+  strcpy(side->temp_name, "/tmp/wdiff.XXXXXX");
+  if ((fd = mkstemp(side->temp_name)) == -1)
+    error (EXIT_OTHER_REASON, errno, side->temp_name);
+  side->temp_file = fdopen(fd, "w");
   if (side->temp_file == NULL)
     error (EXIT_OTHER_REASON, errno, side->temp_name);
 



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]