Commit7496aba

committed

Restrict file mode creation mask during tmpfile().

Per Coverity. Back-patch to 9.0 (all supported versions).Michael Paquier, reviewed (in earlier versions) by Heikki Linnakangas.

1 parente32c5f1 commit7496abaCopy full SHA for 7496aba

File tree

+12

-0

lines changed

+12

-0

lines changed

Lines changed: 12 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -380,8 +380,18 @@ tarOpen(ArchiveHandle AH, const char filename, char mode)`
`380`	`380`	`}`
`381`	`381`	`else`
`382`	`382`	`{`
	`383`	`+intold_umask;`
	`384`	`+`
`383`	`385`	`tm=pg_malloc0(sizeof(TAR_MEMBER));`
`384`	`386`
	`387`	`+/*`
	`388`	`+ * POSIX does not require, but permits, tmpfile() to restrict file`
	`389`	`+ * permissions. Given an OS crash after we write data, the filesystem`
	`390`	`+ * might retain the data but forget tmpfile()'s unlink(). If so, the`
	`391`	`+ * file mode protects confidentiality of the data written.`
	`392`	`+ */`
	`393`	`+old_umask=umask(S_IRWXG \|S_IRWXO);`
	`394`	`+`
`385`	`395`	`#ifndefWIN32`
`386`	`396`	`tm->tmpFH=tmpfile();`
`387`	`397`	`#else`
`@@ -416,6 +426,8 @@ tarOpen(ArchiveHandle AH, const char filename, char mode)`
`416`	`426`	`if (tm->tmpFH==NULL)`
`417`	`427`	`exit_horribly(modulename,"could not generate temporary file name: %s\n",strerror(errno));`
`418`	`428`
	`429`	`+umask(old_umask);`
	`430`	`+`
`419`	`431`	`#ifdefHAVE_LIBZ`
`420`	`432`
`421`	`433`	`if (AH->compression!=0)`

Comments

(0)