Attachment 145853 Details for Bug 223072 – Backported patch that corrects CVE-2006-6939 GNU ed insecure tmp file handling.

[patch] Backported patch that corrects CVE-2006-6939 GNU ed insecure tmp file handling.

ed-0.2-CVE-2006-6939.patch (text/plain), 1.09 KB, created by Lubomir Kundrak on 2007-01-17 19:34:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lubomir Kundrak

Created: 2007-01-17 19:34:49 UTC

Size: 1.09 KB

patch

obsolete

>--- ed-0.2/buf.c.orig	2007-01-17 19:56:18.000000000 +0100
>+++ ed-0.2/buf.c	2007-01-17 20:18:28.000000000 +0100
>@@ -194,8 +194,6 @@ get_addressed_line_node (n)
> 
> extern int newline_added;
> 
>-char sfn[15] = "";		/* scratch file name */
>-
> /* open_sbuf: open scratch file */
> int
> open_sbuf ()
>@@ -204,16 +202,11 @@ open_sbuf ()
>   int u;
> 
>   isbinary = newline_added = 0;
>-  u = umask(077);
>-  strcpy (sfn, "/tmp/ed.XXXXXX");
>-  if (mktemp (sfn) == NULL || (sfp = fopen (sfn, "w+")) == NULL)
>+  if( (sfp = tmpfile()) == NULL )
>     {
>-      fprintf (stderr, "%s: %s\n", sfn, strerror (errno));
>       sprintf (errmsg, "Cannot open temp file");
>-      umask(u);
>       return ERR;
>     }
>-  umask(u);
>   return 0;
> }
> 
>@@ -226,12 +219,10 @@ close_sbuf ()
>     {
>       if (fclose (sfp) < 0)
> 	{
>-	  fprintf (stderr, "%s: %s\n", sfn, strerror (errno));
> 	  sprintf (errmsg, "Cannot close temp file");
> 	  return ERR;
> 	}
>       sfp = NULL;
>-      unlink (sfn);
>     }
>   sfseek = seek_write = 0;
>   return 0;
>@@ -246,7 +237,6 @@ quit (n)
>   if (sfp)
>     {
>       fclose (sfp);
>-      unlink (sfn);
>     }
>   exit (n);
> }

Actions: View | Diff

Attachments on bug 223072: 145853