Improve management of temp files

Bug #402099 reported by arno_b
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
LaTeXDraw
Fix Released
Medium
arno_b

Bug Description

An attacker can stop latexdraw (e.g. send it SIGSTOP), see
what temp file it is using, symlink /tmp/latexdrawTmp1234567.aux to any
random file that the user has permission to write to and then latex will fill
that file with rubbish.

The standard approach for this is to use a separate directory within /tmp for
the set of temp files. The normal way of doing this in a shell script is with
the "mktemp -d" command. The start of some
code to do this properly can be found at:

       http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4735419

as you can see from the comments on the page, it's a non-trivial thing to get
right... marking the directory as .deleteOnExit() also seems sensible to make
sure it's cleaned up should latexdraw crash prior to cleanup.

arno_b (arno.b)
Changed in latexdraw:
assignee: nobody → arno_b (arno.b)
status: New → Fix Committed
arno_b (arno.b)
Changed in latexdraw:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.