cups/patches/020_cups-str3382.patch

   1 diff -up cups-1.5b1/cups/tempfile.c.str3382 cups-1.5b1/cups/tempfile.c
   2 --- cups-1.5b1/cups/tempfile.c.str3382  2010-03-24 01:45:34.000000000 +0100
   3 +++ cups-1.5b1/cups/tempfile.c  2011-05-24 16:04:47.000000000 +0200
   4 @@ -33,6 +33,7 @@
   5  #  include <io.h>
   6  #else
   7  #  include <unistd.h>
   8 +#  include <sys/types.h>
   9  #endif /* WIN32 || __EMX__ */
  10
  11
  12 @@ -54,7 +55,7 @@ cupsTempFd(char *filename,            /* I - Point
  13    char         tmppath[1024];          /* Windows temporary directory */
  14    DWORD                curtime;                /* Current time */
  15  #else
  16 -  struct timeval curtime;              /* Current time */
  17 +  mode_t       old_umask;              /* Old umask before using mkstemp() */
  18  #endif /* WIN32 */
  19
  20
  21 @@ -105,33 +106,25 @@ cupsTempFd(char *filename,                /* I - Point
  22
  23      snprintf(filename, len - 1, "%s/%05lx%08lx", tmpdir,
  24               GetCurrentProcessId(), curtime);
  25 -#else
  26 -   /*
  27 -    * Get the current time of day...
  28 -    */
  29 -
  30 -    gettimeofday(&curtime, NULL);
  31 -
  32 -   /*
  33 -    * Format a string using the hex time values...
  34 -    */
  35 -
  36 -    snprintf(filename, len - 1, "%s/%05x%08x", tmpdir, (unsigned)getpid(),
  37 -             (unsigned)(curtime.tv_sec + curtime.tv_usec + tries));
  38 -#endif /* WIN32 */
  39
  40     /*
  41      * Open the file in "exclusive" mode, making sure that we don't
  42      * stomp on an existing file or someone's symlink crack...
  43      */
  44
  45 -#ifdef WIN32
  46      fd = open(filename, _O_CREAT | _O_RDWR | _O_TRUNC | _O_BINARY,
  47                _S_IREAD | _S_IWRITE);
  48 -#elif defined(O_NOFOLLOW)
  49 -    fd = open(filename, O_RDWR | O_CREAT | O_EXCL | O_NOFOLLOW, 0600);
  50  #else
  51 -    fd = open(filename, O_RDWR | O_CREAT | O_EXCL, 0600);
  52 +
  53 +   /*
  54 +    * Use the standard mkstemp() call to make a temporary filename
  55 +    * securely.  -- andrew.wood@jdplc.com
  56 +    */
  57 +    snprintf(filename, len - 1, "%s/cupsXXXXXX", tmpdir);
  58 +
  59 +    old_umask = umask(0077);
  60 +    fd = mkstemp(filename);
  61 +    umask(old_umask);
  62  #endif /* WIN32 */
  63
  64      if (fd < 0 && errno != EEXIST)