diff options
| author |  David Adam <zanchey@ucc.gu.uwa.edu.au> | 2014-04-20 23:51:20 +0800 |
|---|---|---|
| committer | David Adam <zanchey@ucc.gu.uwa.edu.au> | 2014-04-27 12:26:21 +0800 |
| commit | c0989dce2d882c94eb3183e7b94402ba53534abb (patch) | |
| tree | 65173abe5188984a86fda6e221e4d9128c0ee0de | |
| parent | 8412c867a501e3a68e55fef6215e86d3ac9f617b (diff) | |
use mktemp(1) to generate temporary file names
Fix for CVE-2014-2906.
Closes a race condition in funced which would allow execution of
arbitrary code; closes a race condition in psub which would allow
alternation of the data stream.
Note that `psub -f` does not work (#1040); a fix should be committed
separately for ease of maintenance.
| -rw-r--r-- | share/functions/funced.fish | 6 | ||||
| -rw-r--r-- | share/functions/psub.fish | 11 |
2 files changed, 4 insertions, 13 deletions
diff --git a/share/functions/funced.fish b/share/functions/funced.fish index 3c2de061..ca2e2772 100644 --- a/share/functions/funced.fish +++ b/share/functions/funced.fish @@ -81,11 +81,7 @@ function funced --description 'Edit function definition' return 0 end - set -q TMPDIR; or set -l TMPDIR /tmp - set -l tmpname (printf "$TMPDIR/fish_funced_%d_%d.fish" %self (random)) - while test -f $tmpname - set tmpname (printf "$TMPDIR/fish_funced_%d_%d.fish" %self (random)) - end + set tmpname (mktemp -t fish_funced.XXXXXXXXXX) if functions -q -- $funcname functions -- $funcname > $tmpname diff --git a/share/functions/psub.fish b/share/functions/psub.fish index 42e34c73..7877aa4e 100644 --- a/share/functions/psub.fish +++ b/share/functions/psub.fish @@ -45,21 +45,16 @@ function psub --description "Read from stdin into a file and output the filename return end - # Find unique file name for writing output to - while true - set filename /tmp/.psub.(echo %self).(random); - if not test -e $filename - break; - end - end - if test use_fifo = 1 # Write output to pipe. This needs to be done in the background so # that the command substitution exits without needing to wait for # all the commands to exit + set dir (mktemp -d /tmp/.psub.XXXXXXXXXX); or return + set filename $dir/psub.fifo mkfifo $filename cat >$filename & else + set filename (mktemp /tmp/.psub.XXXXXXXXXX) cat >$filename end |