gnu/packages/patches/a2ps-CVE-2001-1593.patch

   1 Index: b/lib/routines.c
   2 ===================================================================
   3 --- a/lib/routines.c
   4 +++ b/lib/routines.c
   5 @@ -242,3 +242,50 @@
   6    /* Don't complain if you can't unlink.  Who cares of a tmp file? */
   7    unlink (filename);
   8  }
   9 +
  10 +/*
  11 + * Securely generate a temp file, and make sure it gets
  12 + * deleted upon exit.
  13 + */
  14 +static char ** tempfiles;
  15 +static unsigned        ntempfiles;
  16 +
  17 +static void
  18 +cleanup_tempfiles()
  19 +{
  20 +       while (ntempfiles--)
  21 +               unlink(tempfiles[ntempfiles]);
  22 +}
  23 +
  24 +char *
  25 +safe_tempnam(const char *pfx)
  26 +{
  27 +       char    *dirname, *filename;
  28 +       int     fd;
  29 +
  30 +       if (!(dirname = getenv("TMPDIR")))
  31 +               dirname = "/tmp";
  32 +
  33 +       tempfiles = (char **) realloc(tempfiles,
  34 +                       (ntempfiles+1) * sizeof(char *));
  35 +       if (tempfiles == NULL)
  36 +               return NULL;
  37 +
  38 +       filename = malloc(strlen(dirname) + strlen(pfx) + sizeof("/XXXXXX"));
  39 +       if (!filename)
  40 +               return NULL;
  41 +
  42 +       sprintf(filename, "%s/%sXXXXXX", dirname, pfx);
  43 +
  44 +       if ((fd = mkstemp(filename)) < 0) {
  45 +               free(filename);
  46 +               return NULL;
  47 +       }
  48 +       close(fd);
  49 +
  50 +       if (ntempfiles == 0)
  51 +               atexit(cleanup_tempfiles);
  52 +       tempfiles[ntempfiles++] = filename;
  53 +
  54 +       return filename;
  55 +}
  56 Index: b/lib/routines.h
  57 ===================================================================
  58 --- a/lib/routines.h
  59 +++ b/lib/routines.h
  60 @@ -255,7 +255,8 @@
  61  /* If _STR_ is not defined, give it a tempname in _TMPDIR_ */
  62  #define tempname_ensure(Str)                           \
  63  do {                                                   \
  64 -  (Str) = (Str) ? (Str) : tempnam (NULL, "a2_");       \
  65 +  (Str) = (Str) ? (Str) : safe_tempnam("a2_"); \
  66  } while (0)
  67 +char * safe_tempnam(const char *);
  68
  69  #endif