In uip/replsbr.c, replout() calls umask() but does not restore
the old value before it returns. In particular, this causes problems
when doing shell escapes from a vim editor child process under RedHat
Linux (e.g. when typing "!}fmt^M" to format a paragraph.) Vim creates a
directory in /tmp and attempts to place a temporary file in it, but with
the leaked umask the directory is not executable, so the operation fails.
Restoring the umask after opening the draft file fixes the problem.
A patch is included below. This may be a problem elsewhere in the code,
but this is the only case which I encountered.
Gary Duzan
BBN Technologies
A Verizon Company
Index: replsbr.c
===================================================================
RCS file: /cvs/nmh/uip/replsbr.c,v
retrieving revision 1.2
diff -u -r1.2 replsbr.c
--- replsbr.c 1999/07/16 00:59:07 1.2
+++ replsbr.c 2002/05/29 13:57:14
@@ -75,10 +75,12 @@
int char_read = 0, format_len;
char name[NAMESZ], *scanl, *cp;
FILE *out;
+ mode_t old_umask;
- umask(~m_gmprot());
+ old_umask = umask(~m_gmprot());
if ((out = fopen (drft, "w")) == NULL)
adios (drft, "unable to create");
+ umask(old_umask);
/* get new format string */
cp = new_fs (form, NULL, NULL);
