173178 - nsXIEngine.cpp uses tempnam instead of mkstemp

Status: RESOLVED FIXED

(Core Graveyard :: Installer: XPInstall Engine, defect)

Description

[Justin Kirby]

xpinstall/wizard/unix/src2/nsXIEngine.cpp:553

this uses the tempnam function which is deemed unacceptable by gcc3.2 and causes
gcc to exit. The solution is to use the recommendation and change to mkstemp

mTmp = tempnam( (const char *) NULL, "xpi" );

to

mTmp = mkstemp("xpi" );

Comment 1

[Daniel Veditz [:dveditz]]

Before we could change the install code we'd have to make sure all the other
unixes support mkstemp, or change autoconf to check for support so we can ifdef it.

Comment 2

[hacker formerly known as [e-mail]]

The only unices that we build the installer for are solaris & linux and both of
these support mkstemp.  Adding a mkstemp autoconf check (via AC_CHECK_FUNCS) is
fairly simple if you still want to do this so that other OSes can build the
installer via --enable-installer.

Comment 3

[Aleksey Nogin]

This is not just a compilation issue (gcc complains), but also a security issue
(tempnam creates predictable names).

Comment 4

[hacker formerly known as [e-mail]]

Attachment: patch

Comment 5

[Aleksey Nogin]

Comment on attachment 108298 [details] [diff] [review]
patch

This should probably be something along the lines of

mkstemp("/tmp/xpi.XXXXXX")

Comment 6

[hacker formerly known as [e-mail]]

Actually, it turns out that mkstemp isn't a drop in replacement for tempnam.  It
returns a file descriptor not the name of a file.  mkdtemp is what we really
want but that's not available under glibc 2.1 or solaris.  

Comment 7

[hacker formerly known as [e-mail]]

Attachment: v1.1

Comment 8

[hacker formerly known as [e-mail]]

Attachment: v1.2

Comment 9

[hacker formerly known as [e-mail]]

Patch has been checked in.