From owner-cvs-all Tue Feb 5 5:28:41 2002 Delivered-To: cvs-all@freebsd.org Received: from mongrel.pacific.net.au (mongrel.pacific.net.au [61.8.0.107]) by hub.freebsd.org (Postfix) with ESMTP id 060C437B421; Tue, 5 Feb 2002 05:28:36 -0800 (PST) Received: from dungeon.home (ppp133.dyn248.pacific.net.au [203.143.248.133]) by mongrel.pacific.net.au (8.9.3/8.9.3/Debian 8.9.3-21) with ESMTP id AAA19003; Wed, 6 Feb 2002 00:20:23 +1100 X-Authentication-Warning: mongrel.pacific.net.au: Host ppp133.dyn248.pacific.net.au [203.143.248.133] claimed to be dungeon.home Received: from dungeon.home (localhost [127.0.0.1]) by dungeon.home (8.11.3/8.11.1) with ESMTP id g15DY3c18696; Tue, 5 Feb 2002 23:34:03 +1000 (EST) (envelope-from mckay) Message-Id: <200202051334.g15DY3c18696@dungeon.home> To: Kris Kennaway Cc: Ian Dowse , cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org, mckay@thehub.com.au Subject: Re: cvs commit: src/usr.sbin/ctm/ctm_rmail ctm_rmail.c References: <200201222254.g0MMsqg19740@freefall.freebsd.org> <200202041157.g14BvhC06852@dungeon.home> <20020204190431.A36742@xor.obsecurity.org> In-Reply-To: <20020204190431.A36742@xor.obsecurity.org> from Kris Kennaway at "Mon, 04 Feb 2002 19:04:31 -0800" Date: Tue, 05 Feb 2002 23:34:03 +1000 From: Stephen McKay Sender: owner-cvs-all@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Monday, 4th February 2002, Kris Kennaway wrote: >On Mon, Feb 04, 2002 at 09:57:43PM +1000, Stephen McKay wrote: >> This is pretty silly. The right way to fix this is to revert back to >> using mktemp(). Probably revert the whole 1.14 delta. I'll put this >> on my TODO list. > >As I recall, the former use of mktemp() was insecure, which was the >reason it was changed to use the secure mkstemp(). It should not be >regressed. Have a closer look. It's misplaced paranoia. Which other program attempts to guard against malicious file name manipulation in directories that are *not* world writable? All mkstemp() does in this case is leave the files with the wrong permissions. So it's still on my TODO list. By the way, I intend to examine the ctm suite to see what will happen when sequence numbers overflow 4 digits (which should be about a year from now, I think). Probably a few bugs there. Oh, and I'm happy to field ctm related bugs (since I still use it), except for those to do with actually generating deltas (I don't have any control over CTM delta generation). I just never get around to searching the bugs list for things I should care about. Stephen. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe cvs-all" in the body of the message