]>
Commit | Line | Data |
---|---|---|
1f9b7ef8 KB |
1 | diff -up cups-1.5b1/cups/tempfile.c.str3382 cups-1.5b1/cups/tempfile.c |
2 | --- cups-1.5b1/cups/tempfile.c.str3382 2010-03-24 01:45:34.000000000 +0100 | |
3 | +++ cups-1.5b1/cups/tempfile.c 2011-05-24 16:04:47.000000000 +0200 | |
4 | @@ -33,6 +33,7 @@ | |
f92713d3 SS |
5 | # include <io.h> |
6 | #else | |
7 | # include <unistd.h> | |
8 | +# include <sys/types.h> | |
9 | #endif /* WIN32 || __EMX__ */ | |
10 | ||
11 | ||
1f9b7ef8 | 12 | @@ -54,7 +55,7 @@ cupsTempFd(char *filename, /* I - Point |
f92713d3 SS |
13 | char tmppath[1024]; /* Windows temporary directory */ |
14 | DWORD curtime; /* Current time */ | |
15 | #else | |
16 | - struct timeval curtime; /* Current time */ | |
17 | + mode_t old_umask; /* Old umask before using mkstemp() */ | |
18 | #endif /* WIN32 */ | |
19 | ||
20 | ||
1f9b7ef8 | 21 | @@ -105,33 +106,25 @@ cupsTempFd(char *filename, /* I - Point |
f92713d3 SS |
22 | |
23 | snprintf(filename, len - 1, "%s/%05lx%08lx", tmpdir, | |
24 | GetCurrentProcessId(), curtime); | |
25 | -#else | |
26 | - /* | |
27 | - * Get the current time of day... | |
28 | - */ | |
29 | - | |
30 | - gettimeofday(&curtime, NULL); | |
31 | - | |
32 | - /* | |
33 | - * Format a string using the hex time values... | |
34 | - */ | |
35 | - | |
36 | - snprintf(filename, len - 1, "%s/%05x%08x", tmpdir, (unsigned)getpid(), | |
37 | - (unsigned)(curtime.tv_sec + curtime.tv_usec + tries)); | |
38 | -#endif /* WIN32 */ | |
39 | ||
40 | /* | |
41 | * Open the file in "exclusive" mode, making sure that we don't | |
42 | * stomp on an existing file or someone's symlink crack... | |
43 | */ | |
44 | ||
45 | -#ifdef WIN32 | |
46 | fd = open(filename, _O_CREAT | _O_RDWR | _O_TRUNC | _O_BINARY, | |
47 | _S_IREAD | _S_IWRITE); | |
48 | -#elif defined(O_NOFOLLOW) | |
49 | - fd = open(filename, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, 0600); | |
50 | #else | |
51 | - fd = open(filename, O_RDWR | O_CREAT | O_EXCL, 0600); | |
52 | + | |
53 | + /* | |
54 | + * Use the standard mkstemp() call to make a temporary filename | |
55 | + * securely. -- andrew.wood@jdplc.com | |
56 | + */ | |
57 | + snprintf(filename, len - 1, "%s/cupsXXXXXX", tmpdir); | |
58 | + | |
59 | + old_umask = umask(0077); | |
60 | + fd = mkstemp(filename); | |
61 | + umask(old_umask); | |
62 | #endif /* WIN32 */ | |
63 | ||
64 | if (fd < 0 && errno != EEXIST) |