From: Arran Cudbard-Bell <a.cudbardb@freeradius.org>
Date: Fri, 26 May 2017 14:00:06 +0000 (-0400)
Subject: CID 1358898: Set umask if we're running under coverity
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=02b89f5df4888ce2f3296e9ba17e6f298bd9fb70;p=thirdparty%2Ffreeradius-server.git

CID 1358898: Set umask if we're running under coverity
---

diff --git a/src/main/tls/validate.c b/src/main/tls/validate.c
index 07d287ba810..12235414803 100644
--- a/src/main/tls/validate.c
+++ b/src/main/tls/validate.c
@@ -257,6 +257,16 @@ int tls_validate_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
 
 		snprintf(filename, sizeof(filename), "%s/%s.client.XXXXXXXX",
 			 conf->verify_tmp_dir, main_config.name);
+
+#ifdef __COVERITY__
+		/*
+		 *	POSIX-2008 requires that mkstemp creates the file
+		 *	with 0600 permissions.  So setting umask is pointless
+		 *	and although it won't cause crashes, will cause
+		 *	race conditions in threaded environments.
+		 */
+		umask(0600);
+#endif
 		fd = mkstemp(filename);
 		if (fd < 0) {
 			RDEBUG("Failed creating file in %s: %s",