head 1.2; access; symbols pkgsrc-2026Q1:1.2.0.108 pkgsrc-2026Q1-base:1.2 pkgsrc-2025Q4:1.2.0.106 pkgsrc-2025Q4-base:1.2 pkgsrc-2025Q3:1.2.0.104 pkgsrc-2025Q3-base:1.2 pkgsrc-2025Q2:1.2.0.102 pkgsrc-2025Q2-base:1.2 pkgsrc-2025Q1:1.2.0.100 pkgsrc-2025Q1-base:1.2 pkgsrc-2024Q4:1.2.0.98 pkgsrc-2024Q4-base:1.2 pkgsrc-2024Q3:1.2.0.96 pkgsrc-2024Q3-base:1.2 pkgsrc-2024Q2:1.2.0.94 pkgsrc-2024Q2-base:1.2 pkgsrc-2024Q1:1.2.0.92 pkgsrc-2024Q1-base:1.2 pkgsrc-2023Q4:1.2.0.90 pkgsrc-2023Q4-base:1.2 pkgsrc-2023Q3:1.2.0.88 pkgsrc-2023Q3-base:1.2 pkgsrc-2023Q2:1.2.0.86 pkgsrc-2023Q2-base:1.2 pkgsrc-2023Q1:1.2.0.84 pkgsrc-2023Q1-base:1.2 pkgsrc-2022Q4:1.2.0.82 pkgsrc-2022Q4-base:1.2 pkgsrc-2022Q3:1.2.0.80 pkgsrc-2022Q3-base:1.2 pkgsrc-2022Q2:1.2.0.78 pkgsrc-2022Q2-base:1.2 pkgsrc-2022Q1:1.2.0.76 pkgsrc-2022Q1-base:1.2 pkgsrc-2021Q4:1.2.0.74 pkgsrc-2021Q4-base:1.2 pkgsrc-2021Q3:1.2.0.72 pkgsrc-2021Q3-base:1.2 pkgsrc-2021Q2:1.2.0.70 pkgsrc-2021Q2-base:1.2 pkgsrc-2021Q1:1.2.0.68 pkgsrc-2021Q1-base:1.2 pkgsrc-2020Q4:1.2.0.66 pkgsrc-2020Q4-base:1.2 pkgsrc-2020Q3:1.2.0.64 pkgsrc-2020Q3-base:1.2 pkgsrc-2020Q2:1.2.0.60 pkgsrc-2020Q2-base:1.2 pkgsrc-2020Q1:1.2.0.40 pkgsrc-2020Q1-base:1.2 pkgsrc-2019Q4:1.2.0.62 pkgsrc-2019Q4-base:1.2 pkgsrc-2019Q3:1.2.0.58 pkgsrc-2019Q3-base:1.2 pkgsrc-2019Q2:1.2.0.56 pkgsrc-2019Q2-base:1.2 pkgsrc-2019Q1:1.2.0.54 pkgsrc-2019Q1-base:1.2 pkgsrc-2018Q4:1.2.0.52 pkgsrc-2018Q4-base:1.2 pkgsrc-2018Q3:1.2.0.50 pkgsrc-2018Q3-base:1.2 pkgsrc-2018Q2:1.2.0.48 pkgsrc-2018Q2-base:1.2 pkgsrc-2018Q1:1.2.0.46 pkgsrc-2018Q1-base:1.2 pkgsrc-2017Q4:1.2.0.44 pkgsrc-2017Q4-base:1.2 pkgsrc-2017Q3:1.2.0.42 pkgsrc-2017Q3-base:1.2 pkgsrc-2017Q2:1.2.0.38 pkgsrc-2017Q2-base:1.2 pkgsrc-2017Q1:1.2.0.36 pkgsrc-2017Q1-base:1.2 pkgsrc-2016Q4:1.2.0.34 pkgsrc-2016Q4-base:1.2 pkgsrc-2016Q3:1.2.0.32 pkgsrc-2016Q3-base:1.2 pkgsrc-2016Q2:1.2.0.30 pkgsrc-2016Q2-base:1.2 pkgsrc-2016Q1:1.2.0.28 pkgsrc-2016Q1-base:1.2 pkgsrc-2015Q4:1.2.0.26 pkgsrc-2015Q4-base:1.2 pkgsrc-2015Q3:1.2.0.24 pkgsrc-2015Q3-base:1.2 pkgsrc-2015Q2:1.2.0.22 pkgsrc-2015Q2-base:1.2 pkgsrc-2015Q1:1.2.0.20 pkgsrc-2015Q1-base:1.2 pkgsrc-2014Q4:1.2.0.18 pkgsrc-2014Q4-base:1.2 pkgsrc-2014Q3:1.2.0.16 pkgsrc-2014Q3-base:1.2 pkgsrc-2014Q2:1.2.0.14 pkgsrc-2014Q2-base:1.2 pkgsrc-2014Q1:1.2.0.12 pkgsrc-2014Q1-base:1.2 pkgsrc-2013Q4:1.2.0.10 pkgsrc-2013Q4-base:1.2 pkgsrc-2013Q3:1.2.0.8 pkgsrc-2013Q3-base:1.2 pkgsrc-2013Q2:1.2.0.6 pkgsrc-2013Q2-base:1.2 pkgsrc-2013Q1:1.2.0.4 pkgsrc-2013Q1-base:1.2 pkgsrc-2012Q4:1.2.0.2 pkgsrc-2012Q4-base:1.2 pkgsrc-2012Q3:1.1.0.10 pkgsrc-2012Q3-base:1.1 pkgsrc-2012Q2:1.1.0.8 pkgsrc-2012Q2-base:1.1 pkgsrc-2012Q1:1.1.0.6 pkgsrc-2012Q1-base:1.1 pkgsrc-2011Q4:1.1.0.4 pkgsrc-2011Q4-base:1.1 pkgsrc-2011Q3:1.1.0.2; locks; strict; comment @# @; 1.2 date 2012.10.20.22.11.30; author joerg; state Exp; branches; next 1.1; 1.1 date 2011.11.06.19.32.07; author dholland; state Exp; branches 1.1.2.1; next ; 1.1.2.1 date 2011.11.06.19.32.07; author spz; state dead; branches; next 1.1.2.2; 1.1.2.2 date 2011.11.06.20.31.01; author spz; state Exp; branches; next ; desc @@ 1.2 log @Return without value iff the function has a return type of void. @ text @$NetBSD: patch-yacc_main_c,v 1.1 2011/11/06 19:32:07 dholland Exp $ Avoid insecure use of mktemp(). --- yacc/main.c~ 1995-06-07 09:34:32.000000000 -0400 +++ yacc/main.c 2008-09-04 22:15:26.000000000 -0400 @@@@ -1,4 +1,5 @@@@ #include +#include /* for mkstemp(), getenv() */ #include "defs.h" char dflag; @@@@ -31,6 +32,11 @@@@ char *text_file_name; char *union_file_name; char *verbose_file_name; +static int action_fd = -1; +static int entry_fd = -1; +static int text_fd = -1; +static int union_fd = -1; + FILE *action_file; /* a temp file, used to save actions associated */ /* with rules until the parser is written */ FILE *entry_file; @@@@ -69,9 +75,6 @@@@ char *rassoc; short **derives; char *nullable; -extern char *mktemp(); -extern char *getenv(); - done(k) int k; @@@@ -121,7 +124,7 @@@@ usage() exit(1); } -getargs(argc, argv) +void getargs(argc, argv) int argc; char *argv[]; { @@@@ -276,12 +279,21 @@@@ create_file_names() union_file_name[len + 5] = 'u'; #ifndef NO_UNIX - mktemp(action_file_name); - mktemp(entry_file_name); - mktemp(text_file_name); - mktemp(union_file_name); + action_fd = mkstemp(action_file_name); + entry_fd = mkstemp(entry_file_name); + text_fd = mkstemp(text_file_name); + union_fd = mkstemp(union_file_name); #endif + if (action_fd < 0) + open_error(action_file_name); + if (entry_fd < 0) + open_error(entry_file_name); + if (text_fd < 0) + open_error(text_file_name); + if (union_fd < 0) + open_error(union_file_name); + len = strlen(file_prefix); output_file_name = MALLOC(len + 7); @@@@ -321,15 +333,15 @@@@ open_files() open_error(input_file_name); } - action_file = fopen(action_file_name, "w"); + action_file = fdopen(action_fd, "w"); if (action_file == 0) open_error(action_file_name); - entry_file = fopen(entry_file_name, "w"); + entry_file = fdopen(entry_fd, "w"); if (entry_file == 0) open_error(entry_file_name); - text_file = fopen(text_file_name, "w"); + text_file = fdopen(text_fd, "w"); if (text_file == 0) open_error(text_file_name); @@@@ -345,7 +357,7 @@@@ open_files() defines_file = fopen(defines_file_name, "w"); if (defines_file == 0) open_error(defines_file_name); - union_file = fopen(union_file_name, "w"); + union_file = fdopen(union_fd, "w"); if (union_file == 0) open_error(union_file_name); } @ 1.1 log @Fix insecure-temp-files, PR 45558 @ text @d1 1 a1 1 $NetBSD$ d35 9 @ 1.1.2.1 log @file patch-yacc_main_c was added on branch pkgsrc-2011Q3 on 2011-11-06 20:31:01 +0000 @ text @d1 88 @ 1.1.2.2 log @Pullup ticket #3592 - requested by dholland lang/caml-light: security patch Revisions pulled up: - lang/caml-light/Makefile 1.13 - lang/caml-light/distinfo 1.9 - lang/caml-light/patches/patch-yacc_main_c 1.1 ------------------------------------------------------------------- Module Name: pkgsrc Committed By: dholland Date: Sun Nov 6 19:32:07 UTC 2011 Modified Files: pkgsrc/lang/caml-light: Makefile distinfo Added Files: pkgsrc/lang/caml-light/patches: patch-yacc_main_c Log Message: Fix insecure-temp-files, PR 45558 To generate a diff of this commit: cvs rdiff -u -r1.12 -r1.13 pkgsrc/lang/caml-light/Makefile cvs rdiff -u -r1.8 -r1.9 pkgsrc/lang/caml-light/distinfo cvs rdiff -u -r0 -r1.1 pkgsrc/lang/caml-light/patches/patch-yacc_main_c @ text @a0 88 $NetBSD$ Avoid insecure use of mktemp(). --- yacc/main.c~ 1995-06-07 09:34:32.000000000 -0400 +++ yacc/main.c 2008-09-04 22:15:26.000000000 -0400 @@@@ -1,4 +1,5 @@@@ #include +#include /* for mkstemp(), getenv() */ #include "defs.h" char dflag; @@@@ -31,6 +32,11 @@@@ char *text_file_name; char *union_file_name; char *verbose_file_name; +static int action_fd = -1; +static int entry_fd = -1; +static int text_fd = -1; +static int union_fd = -1; + FILE *action_file; /* a temp file, used to save actions associated */ /* with rules until the parser is written */ FILE *entry_file; @@@@ -69,9 +75,6 @@@@ char *rassoc; short **derives; char *nullable; -extern char *mktemp(); -extern char *getenv(); - done(k) int k; @@@@ -276,12 +279,21 @@@@ create_file_names() union_file_name[len + 5] = 'u'; #ifndef NO_UNIX - mktemp(action_file_name); - mktemp(entry_file_name); - mktemp(text_file_name); - mktemp(union_file_name); + action_fd = mkstemp(action_file_name); + entry_fd = mkstemp(entry_file_name); + text_fd = mkstemp(text_file_name); + union_fd = mkstemp(union_file_name); #endif + if (action_fd < 0) + open_error(action_file_name); + if (entry_fd < 0) + open_error(entry_file_name); + if (text_fd < 0) + open_error(text_file_name); + if (union_fd < 0) + open_error(union_file_name); + len = strlen(file_prefix); output_file_name = MALLOC(len + 7); @@@@ -321,15 +333,15 @@@@ open_files() open_error(input_file_name); } - action_file = fopen(action_file_name, "w"); + action_file = fdopen(action_fd, "w"); if (action_file == 0) open_error(action_file_name); - entry_file = fopen(entry_file_name, "w"); + entry_file = fdopen(entry_fd, "w"); if (entry_file == 0) open_error(entry_file_name); - text_file = fopen(text_file_name, "w"); + text_file = fdopen(text_fd, "w"); if (text_file == 0) open_error(text_file_name); @@@@ -345,7 +357,7 @@@@ open_files() defines_file = fopen(defines_file_name, "w"); if (defines_file == 0) open_error(defines_file_name); - union_file = fopen(union_file_name, "w"); + union_file = fdopen(union_fd, "w"); if (union_file == 0) open_error(union_file_name); } @