commit/gnus: matsl: Remove security issue with predictable temp-file-name

1 new commit in gnus:

https://bitbucket.org/xemacs/gnus/commits/de3a26f0a6a6/
Changeset:   de3a26f0a6a6
User:        matsl
Date:        2014-05-21 15:46:07
Summary:     Remove security issue with predictable temp-file-name

2014-05-18  Mats Lidell  <[email protected]>

        * gnus-fun.el (gnus-grab-cam-face): Upstream security issue. Do
        not use predictable temp-file name.
        (http://bugs.debian.org/747100) Patch by Glenn Morris.
Affected #:  2 files

diff -r fbd60960928439b47a767ff913e9f289c3e4d811 -r de3a26f0a6a657e20c40fd622ac6f7a6a97c5a91 ChangeLog
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2014-05-18  Mats Lidell  <[email protected]>
+
+	* gnus-fun.el (gnus-grab-cam-face): Upstream security issue. Do
+	not use predictable temp-file name.
+	(http://bugs.debian.org/747100) Patch by Glenn Morris.
+
 2014-05-15  Norbert Koch  <[email protected]>
 
 	* Makefile (VERSION): XEmacs package 1.97 released.

diff -r fbd60960928439b47a767ff913e9f289c3e4d811 -r de3a26f0a6a657e20c40fd622ac6f7a6a97c5a91 lisp/gnus-fun.el
--- a/lisp/gnus-fun.el
+++ b/lisp/gnus-fun.el
@@ -227,20 +227,21 @@
   (interactive)
   (shell-command "xawtv-remote snap ppm")
   (let ((file nil)
+	(tempfile (make-temp-file "gnus-face-" nil ".ppm"))
 	result)
     (while (null (setq file (directory-files "/tftpboot/sparky/tmp"
 					     t "snap.*ppm")))
       (sleep-for 1))
     (setq file (car file))
     (shell-command
-     (format "pnmcut -left 110 -top 30 -width 144 -height 144 '%s' | pnmscale -width 48 -height 48 | ppmtopgm > /tmp/gnus.face.ppm"
-	     file))
+     (format "pnmcut -left 110 -top 30 -width 144 -height 144 '%s' | pnmscale -width 48 -height 48 | ppmtopgm > %s"
+	     file tempfile))
     (let ((gnus-convert-image-to-face-command
 	   (format "cat '%%s' | ppmquant %%d | ppmchange %s | pnmtopng"
 		   (gnus-fun-ppm-change-string))))
-      (setq result (gnus-face-from-file "/tmp/gnus.face.ppm")))
+      (setq result (gnus-face-from-file tempfile)))
     (delete-file file)
-    ;;(delete-file "/tmp/gnus.face.ppm")
+    ;;(delete-file tempfile)    ; FIXME why are we not deleting it?!
     result))
 
 (defun gnus-fun-ppm-change-string ()

Repository URL: https://bitbucket.org/xemacs/gnus/

--

This is a commit notification from bitbucket.org. You are receiving
this because you have the service enabled, addressing the recipient of
this email.