GBool openTempFile(GooString **name, FILE **f, const char *mode) {
#if defined(_WIN32)
  //---------- Win32 ----------
  char *tempDir;
  GooString *s, *s2;
  FILE *f2;
  int t, i;

  // this has the standard race condition problem, but I haven't found
  // a better way to generate temp file names with extensions on
  // Windows
  if ((tempDir = getenv("TEMP"))) {
    s = new GooString(tempDir);
    s->append('\\');
  } else {
    s = new GooString();
  }
  s->appendf("x_{0:d}_{1:d}_",
    (int)GetCurrentProcessId(), (int)GetCurrentThreadId());
  t = (int)time(NULL);
  for (i = 0; i < 1000; ++i) {
    s2 = s->copy()->appendf("{0:d}", t + i);
    if (!(f2 = fopen(s2->getCString(), "r"))) {
      if (!(f2 = fopen(s2->getCString(), mode))) {
delete s2;
delete s;
        return gFalse;
      }
      *name = s2;
      *f = f2;
      delete s;
      return gTrue;
    }
    fclose(f2);
    delete s2;
  }
  delete s;
  return gFalse;
#elif defined(VMS) || defined(__EMX__) || defined(ACORN) || defined(MACOS)
  //---------- non-Unix ----------
  char *s;

  // There is a security hole here: an attacker can create a symlink
  // with this file name after the tmpnam call and before the fopen
  // call.  I will happily accept fixes to this function for non-Unix
  // OSs.
  if (!(s = tmpnam(NULL))) {
    return gFalse;
  }
  *name = new GooString(s);
  if (!(*f = fopen((*name)->getCString(), mode))) {
    delete (*name);
    *name = NULL;
    return gFalse;
  }
  return gTrue;

Created xpdf tracking bugs for this issue:

Affects: fedora-all [bug 1024766]
Affects: epel-all [bug 1024767]

Created poppler tracking bugs for this issue:

Affects: fedora-all [bug 1024765]

(In reply to Ratul Gupta from comment #3)
> Created poppler tracking bugs for this issue:
> 
> Affects: fedora-all [bug 1024765]

Hi,

do we really need to fix this in fedora's poppler? From my understaning, it should affect just non-UNIX OSs.

Regards

Marek

Statement:

Not Vulnerable. This issue does not affect the version of poppler as shipped with Red Hat Enterprise Linux 5 and 6.

This issue does not affect the version of poppler in Linux/Unix.