lha is broken in gutsy amd64

[sles]

Binary package hint: lha

lha ao5g books.lzh *.txt
LHa: Fatal error: /tmp/lhxuroBy: File exists

strace shows that lha tries to open file twice
stat("books.lzh", {st_mode=S_IFREG|0644, st_size=343457, ...}) = 0
open("books.lzh", O_RDONLY) = 4
gettimeofday({1196505602, 305697}, NULL) = 0
getpid() = 10261
open("/tmp/lhN1sX5j", O_RDWR|O_CREAT|O_EXCL, 0600) = 6
rt_sigaction(SIGINT, {0x402640, [INT], SA_RESTORER|SA_RESTART, 0x2b0bf4def7d0}, {SIG_DFL}, 8) = 0
rt_sigaction(SIGHUP, {0x402640, [HUP], SA_RESTORER|SA_RESTART, 0x2b0bf4def7d0}, {SIG_DFL}, 8) = 0
umask(077) = 022
open("/tmp/lhN1sX5j", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EEXIST (File exists)
write(2, "LHa: Fatal error: ", 18LHa: Fatal error: ) = 18
write(2, "/tmp/lhN1sX5j: File exists\n", 27/tmp/lhN1sX5j: File exists

lha from fiesty works OK.

[Cesare Tirabassi (norsetto)]

The security patch 2007-2030 (see for instance http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2030) seems to be quite badly conceived.
It mixes two things:

- makes sure that some buffers are zero-terminated
- introduces a new fopen for temporary files which includes the O_CREAT and O_EXCL flags

the problem with this latter is that the temporary file is already created with mkstemp, so this new call just make the program exit with an error and makes it totally unusable.
Since this fix doesn't seem to be needed at all (mkstemp already open the temporary file with these flags, and it uses mode 0600 since glibc 2.0.7) shouldn't we simply remove this part of the fix?

[Philipp Kern (pkern)]

(Hopefully) fixed in lha 1.14i-10.3.

[Philipp Kern (pkern)]

Hopefully fixed in Hardy.