The exifautotran script included in media-libs/jpeg uses a hardcoded name 'tempfile' for temporary file operations. This will also obviously fail if you don't have write privilages for the current directory. The security aspect is a potential symlink vulnerability, as well as the issue of the script overwriting any other 'tempfile' you might have in the current directory. It also makes running multiple instances of the script somewhat challenging. Reproducible: Always Steps to Reproduce: 1. Create a file in the local directory called 'tempfile' 2. Find a JPEG file where the exif data says the image requires rotation (http://old.aylett.co.uk/~axa/img_0183.jpg) 3. Run exifautotran on that jpeg file 4. Run exifautotran on a fresh instance of the jpeg file from a directory you have no write access to Actual Results: The file created in step one is gone, step four fails Expected Results: The file is left intact, both steps three and four result in a rotated jpeg file Simple fix to use mktemp instead: --- exifautotran~ 2007-01-02 16:44:23.000000000 +0000 +++ exifautotran 2007-02-08 16:24:38.000000000 +0000 @@ -27,14 +27,15 @@ 8) transform="-rotate 270";; *) transform="";; esac + TMPFILE=`mktemp` || exit 1 if test -n "$transform"; then echo Executing: jpegtran -copy all $transform $i >&2 - jpegtran -copy all $transform "$i" > tempfile + jpegtran -copy all $transform "$i" > $TMPFILE if test $? -ne 0; then echo Error while transforming $i - skipped. >&2 + rm $TMPFILE else rm "$i" - mv tempfile "$i" + mv $TMPFILE "$i" jpegexiforient -1 "$i" > /dev/null fi fi
Thanks for the report, although its not good practice for the reasons you describe, the security team wont usually consider using the cwd insecurely as a security issue unless there are exceptional circumstances. However, the maintainer may wish to apply your patch anyway. Believe it or not, this is actually reccommended by several well published secure coding guides (eg, check out the Secure Programming HOWTO, section 7.10.1.2). Reassinging to graphics team...
fixed in jpeg-6b-r8
