Date: Mon, 6 Apr 1998 22:00:05 -0400 (EDT) From: ahobson@mindspring.com To: FreeBSD-gnats-submit@FreeBSD.ORG Subject: bin/6232: bug in lib/libc/stdio/mktemp.c Message-ID: <199804070200.WAA29450@computer.eng.mindspring.net>
index | next in thread | raw e-mail
>Number: 6232
>Category: bin
>Synopsis: possible reference to unitialized variable
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Mon Apr 6 19:10:01 PDT 1998
>Last-Modified:
>Originator: Andrew Hobson
>Organization:
MindSpring
>Release: FreeBSD 3.0-CURRENT i386
>Environment:
mktemp.c version 1.8
>Description:
mktemp(3) will occasionally coredump.
>How-To-Repeat:
The following program will coredump after a few iterations.
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>
int
main(int argc, char *argv[])
{
char ts[] = "/home/ahobson/src/tmp/IncomingXXXXXX";
char s[256];
char *r;
int i;
for (i=0; i < 1000; i++) {
strncpy(s, ts, 256);
fprintf(stderr, "mktemp(%s): ", s);
if (NULL == (r=mktemp(s))) {
fprintf(stderr, "NULL!!\n");
exit(1);
} else {
fprintf(stderr, "%s\n", r);
}
if (0 > creat(r, 0644)) {
fprintf(stderr, "Cannot creat(%s): %s\n", r, strerror(errno));
}
}
exit(0);
}
>Fix:
This fixes the problem. I'm not sure it's the right fix.
--- /usr/src/lib/libc/stdio/mktemp.c Sun Apr 5 22:36:52 1998
+++ mktemp.c Mon Apr 6 21:57:41 1998
@@ -121,6 +121,8 @@
*trv-- = c;
}
+ start = trv;
+
/*
* check the target directory; if you have six X's and it
* doesn't exist this runs for a *very* long time.
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199804070200.WAA29450>