bash and /tmp/ ... another one

[Marcus Meissner]

Hi,

While scanning huge grep logs, I found another /tmp race condition in 
bash/bash2.

Actually there are 3 occurences, but only 1 of them is for real I think.

builtins/fc.def:        "/tmp/bash%d" 
                        fopen("w")

        This is the visual history editor. Affected.

subst.c:
          tname = mktemp (savestring ("/tmp/sh-np-XXXXXX"));
          if (mkfifo (tname, 0600) < 0)

          mkfifo fortunately does not appear to follow symlinks on Linux.
          Not affected.

bash/bash2: error.c::trace()
          if (tracefp == NULL)
              tracefp = fopen("/tmp/bash-trace.log", "a+");

        This is if 0ed in our copy of bash-1, but enabled in bash-2.

I did patch the first problem (the patch should work in both bash versions).
I did not patch the second problem for bash2.

Sorry for not autoconfing this.

Ciao, Marcus

bash-1.14.7-temp.patch
Description: Source code patch