Description of Problem: Ispell uses mktemp/fopen for creating a temporary file. Because fopen doesn't use O_EXCL this has a temp race. (Also I noticed (w/strace) that ispell tries to unlink the tempfile twice) Expected Results: ispell should use mkstemp/fdopen to prevent the temp race. (Also it might be a good idea to use TMPDIR (if available) instead of /tmp).
Created attachment 19530 [details] Patch for ispell to use mkstemp/fdopen
ispell 3.1.20-25.52 and 3.1.20-26 has this fix included...
sq.c and unsq.c use gets. OpenBSD has a patch for these (gets->fgets): http://www.openbsd.org/cgi-bin/cvsweb/ports/textproc/ispell/patches/ (They have also a patch for the mktemp that's a little shorter than the one I posted)
I think I'll let the gets stay... is there any risk for doing anything but crashing your own, nonsuid app?
Ispell bugs might matter when it's called from IMP-webmail for example. I haven't checked if the gets are in ispell or in the helper applications (or if they can be exploited at all) probably not a big deal.
Can you take a look at the attached patch? It's a mix of three of OpenBSD's patches
Created attachment 19971 [details] Suggested patch for ispell to use mkstemp and convert some gets...
The patch looks good to me.
Preparing errata with the above patch...
The errata was released yesterday... thanks for your input.