Insecure temporary file use in OCAL code

[Lubomir Rintel]

Here are the patches:

This one is ugly. Pardon me, I never wrote C++ code longer than three lines before.
If someone uses "Mentor someone fixing this bug" I'd be very happy.
http://cvs.fedora.redhat.com/viewcvs/*checkout*/rpms/inkscape/devel/inkscape-0.46pre1-ocal1.patch

This one is not as ugly as first. Also contains workaround for bug #179326
http://cvs.fedora.redhat.com/viewcvs/*checkout*/rpms/inkscape/devel/inkscape-0.46pre1-ocal2.patch

[Lubomir (lubomir-redhat-bugs)]

Description of problem:

Inkscape uses predictable names for OCAL feed's and thumbnails' temporary files,
which make it possible for a local attacker to overwrite files via symlink attack.

[Lubomir (lubomir-redhat-bugs)]

Fixed in inkscape-0.45.1+0.46pre1-4

[Lubomir (lubomir-redhat-bugs)]

https://bugs.launchpad.net/fedora/+source/inkscape/+bug/191847

[Lubomir (lubomir-redhat-bugs)]

CVE name was requested.

[Lubomir Rintel (lkundrak)]

Note -ocal1.patch also fixes a functionality bug. If two cliparts possibly in different directories had same file name, only thumbnail of the first one would be visible.

[Lubomir Rintel (lkundrak)]

Actually -ocal1.patch is broken. Choosing a random file name such as /tmp/mHpvUM looses the file extenstion and in case it's not SVG inkscape won't be able to open it as it won't be able to determine the file type. Possible solution would be to use a temporary directory so that it will be possible for file names to be chosen arbitrarily instead of randomly.

[Kees Cook (kees)]

I've applied ocal2.patch to SVN now. Thanks for these fixes!

I'm investigating other solutions for the ocal1.patch issues.

[Kees Cook (kees)]

Based on Lubomir's patch, I've fixed up the temp file handling. While it might be possible to DoS-race the target, it is no longer vulnerable to overwrite attacks.