72d0164644
tmpnam() is inherently insecure due to race conditions between
filename generation and file creation (CWE-377). Replace all
occurrences with mkstemp() which atomically creates the file.
Pattern used (portable, already used elsewhere in CDE):
strcpy(tmpName, "/tmp/dtXXX_XXXXXX");
{ int _tf = mkstemp(tmpName); if (_tf >= 0) close(_tf); }
Files modified:
- lib/DtHelp/Access.c (2 occurrences)
- lib/DtSvc/DtUtil1/DtsMM.c (1 occurrence)
- lib/DtWidget/Editor.c (2 occurrences)
- lib/DtWidget/SearchCalls.c (1 occurrence)
- programs/dtcreate/main.c (2 occurrences)
- programs/dticon/main.c (1 occurrence)
- programs/dtlogin/policy.c (1 occurrence)
- programs/dtpad/fileIo.c (1 occurrence)
- programs/dtpdm/PdmXp.c (1 occurrence)
- programs/dtpdmd/manager.c (1 occurrence)
- programs/dtspcd/main.c (1 occurrence)
- programs/dtwm/WmResParse.c (1 occurrence)
Note: dtksh/ksh93 directory intentionally skipped (vendored code)
|
||
|---|---|---|
| .. | ||
| Makefile.am | ||
| dtspcdenv.src | ||
| main.c | ||
| spc-xt.c | ||
| spcd_event.c | ||
| spcd_event.h | ||