tempnam bug

Thread View: comp.bugs.4bsd

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Antti Louko Thu, 21 Feb 1991 14:48

#330

Author: Antti Louko
Date: Thu, 21 Feb 1991 14:48

50 lines
1709 bytes

Just found this in public Reno distribution:

src/lib/libc/gen/tmpnam.c, function tempnam()

...
	if (f = getenv("TMPDIR")) {
		(void)sprintf(name, "%s/%sXXXXXX", f, pfx ? "" : pfx);
		if (f = mktemp(name))
			return(f);
	}
	if (dir) {
		(void)sprintf(name, "%s/%sXXXXXX", dir, pfx ? "" : pfx);
		if (f = mktemp(name))
			return(f);
	}
	(void)sprintf(name, "%s/%sXXXXXX", P_tmpdir, pfx ? "" : pfx);
	if (f = mktemp(name))
		return(f);
	(void)sprintf(name, "/tmp/%sXXXXXX", pfx ? "" : pfx);
	if (!(f = mktemp(name)))
		(void)free(name);
...

This should of course be:

...
	if (f = getenv("TMPDIR")) {
		(void)sprintf(name, "%s/%sXXXXXX", f, pfx ? pfx : "");
		if (f = mktemp(name))
			return(f);
	}
	if (dir) {
		(void)sprintf(name, "%s/%sXXXXXX", dir, pfx ? pfx : "");
		if (f = mktemp(name))
			return(f);
	}
	(void)sprintf(name, "%s/%sXXXXXX", P_tmpdir, pfx ? pfx : "");
	if (f = mktemp(name))
		return(f);
	(void)sprintf(name, "/tmp/%sXXXXXX", pfx ? pfx : "");
	if (!(f = mktemp(name)))
		(void)free(name);
...

This can cause very interesting bugs for programs using different temp
files.

	Antti Louko (alo@hut.fi)
	Helsinki University of Technology
	Computing Centre

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads