[patch] patch to fix insecure mktemp use; put it in ${FILESDIR}/rdist_mkstemp.patch

rdist_mkstemp.patch (text/plain), 824 bytes, created by splite on 2005-01-20 10:11:39 UTC

--- src/message.c.orig	1998-11-09 23:13:30.000000000 -0500
+++ src/message.c	2005-01-20 11:39:48.156866817 -0500
@@ -455,6 +455,8 @@
 	int flags;
 	char *msgbuf;
 {
+	int fd;
+
 	if (IS_ON(flags, MT_DEBUG))
 		return;
 
@@ -475,10 +477,12 @@
 		(void) sprintf(tempfile, "%s/%s", cp, _RDIST_TMP);
 
 		msgfac->mf_filename = tempfile;
-		(void) mktemp(msgfac->mf_filename);
-		if ((msgfac->mf_fptr = fopen(msgfac->mf_filename, "w"))==NULL)
+		if ((fd = mkstemp(msgfac->mf_filename)) == -1)
 			fatalerr("Cannot open notify file for writing: %s: %s.",
 			      msgfac->mf_filename, SYSERR);
+		if ((msgfac->mf_fptr = fdopen(fd, "w")) == NULL)
+			fatalerr("Cannot associate stream with file %s: %s.",
+			      msgfac->mf_filename, SYSERR);
 		debugmsg(DM_MISC, "Created notify temp file '%s'",
 			 msgfac->mf_filename);
 	}