[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: temporary file race in texindex

From: Frank Küster
Subject: Re: temporary file race in texindex
Date: Wed, 28 Sep 2005 19:02:30 +0200
User-agent: Gnus/5.1007 (Gnus v5.10.7) Emacs/21.4 (gnu/linux)

address@hidden (Karl Berry) wrote:

>     > This has been assigned CAN-2005-3011, please mention this number in
>     > the changelog when you fix this to allow easy tracking.
> Someone, please send me the actual bug report, and (hopefully) a fix.

Excuse me - any Debian bug report can be accessed via its bug number, so
this time it is


The text is:

| There is a race condition on creating temporary files in texindex.
| The following function generates the name of the temporary file:
| static char *
| maketempname (int count)
| {
|   static char *tempbase = NULL;
|   char tempsuffix[10];
|   if (!tempbase)
|     {
|       int fd;
|       tempbase = concat (tempdir, "txidxXXXXXX");
|       fd = mkstemp (tempbase);
|       if (fd == -1)
|         pfatal_with_name (tempbase);
|     }
|   sprintf (tempsuffix, ".%d", count);
|   return concat (tempbase, tempsuffix);
| }
| which is used later as
|  char *outname = maketempname (++tempcount);
|  FILE *ostream = fopen (outname, "w");
| Since the further filenames are deterministic after the first one
| is generated, this is easily exploitable.
| The use case is rather rare though since the temporary file are only
| generated if the file to sort is longer than 50.000 lines which is
| probably not too common.

Frank also commented on a potential patch:

| In OpenBSD this seems to have been fixed in 2000 (sic!), see this patch
| (which probably doesn't apply today cleanly anymore but could be adapted).
| It introduces a possibility for DoS but fixes the race...

I don't see why texindex cannot simply use completely random filenames?
They are saved in an array and accessed as tempfiles[i], anyway.

Regards, Frank
Frank Küster
Inst. f. Biochemie der Univ. Zürich
Debian Developer

reply via email to

[Prev in Thread] Current Thread [Next in Thread]