Bug#445308: Multiple symlink vulnerabilities

[Nico Golde]

Hi,
I intend to NMU this bug.
The attached patch fixes this issue.
It will be also archived on:
http://people.debian.org/~nion/nmu-diff/guilt_0.27-1_0.27-1.1.patch

Kind regards
Nico
-- 
Nico Golde - http://ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

diff -Nurad guilt-0.27~/guilt guilt-0.27/guilt
--- guilt-0.27~/guilt	2007-08-01 21:01:21.000000000 +0200
+++ guilt-0.27/guilt	2007-10-06 12:42:30.000000000 +0200
@@ -20,6 +20,11 @@
 	;;
 esac
 
+TMP_LOG="$(mktemp /tmp/guilt.log.XXXXXXXXXXXXXXX || exit 1)"
+TMP_MSG="$(mktemp /tmp/guilt.msg.XXXXXXXXXXXXXXX || exit 1)"
+TMP_DIFF="$(mktemp /tmp/guilt.diff.XXXXXXXXXXXXXXX || exit 1)"
+
+
 # we change directories ourselves
 SUBDIRECTORY_OK=1
 
@@ -392,23 +397,23 @@
 				reject=""
 			fi
 			git-apply -C$guilt_push_diff_context --index \
-				$reject "$p" > /dev/null 2> /tmp/guilt.log.$$
+				$reject "$p" > /dev/null 2> "$TMP_LOG"
 			__push_patch_bail=$?
 
 			if [ $__push_patch_bail -ne 0 ]; then
-				cat /tmp/guilt.log.$$ >&2
+				cat "$TMP_LOG" >&2
 				if [ "$bail_action" = "abort" ]; then
-					rm -f /tmp/guilt.log.$$ /tmp/guilt.msg.$$
+					rm -f "$TMP_LOG" "$TMP_MSG"
 					return $__push_patch_bail
 				fi
 			fi
 		fi
 
 		# grab a commit message out of the patch
-		do_get_header "$p" > /tmp/guilt.msg.$$
+		do_get_header "$p" > "$TMP_MSG"
 
 		# make a default commit message if patch doesn't contain one
-		[ ! -s /tmp/guilt.msg.$$ ] && echo "patch $pname" > /tmp/guilt.msg.$$
+		[ ! -s "$TMP_MSG" ] && echo "patch $pname" > "$TMP_MSG"
 
 		# extract a From line from the patch header, and set
 		# GIT_AUTHOR_{NAME,EMAIL}
@@ -436,7 +441,7 @@
 	# update references to top, bottom, and base of the stack
 	update_stack_tags
 
-	rm -f /tmp/guilt.msg.$$ /tmp/guilt.log.$$
+	rm -f "$TMP_MSG" "$TMP_LOG"
 	return $__push_patch_bail
 }
 
@@ -480,7 +485,7 @@
 		git-diff-files --name-only | (while read n; do git-update-index "$n" ; done)
 
 		# get the patch header
-		do_get_full_header "$p" > /tmp/guilt.diff.$$
+		do_get_full_header "$p" > "$TMP_DIFF"
 
 		[ ! -z "$4" ] && diffopts="-C -M --find-copies-harder"
 		
@@ -489,11 +494,11 @@
 				echo "---"
 				git-diff --stat $diffopts "$2"
 				echo ""
-			) >> /tmp/guilt.diff.$$
+			) >> "$TMP_DIFF"
 		fi
 
 		# get the new patch
-		git-diff $diffopts "$2" >> /tmp/guilt.diff.$$
+		git-diff $diffopts "$2" >> "$TMP_DIFF"
 
 		# move the new patch in
 		mv "$p" "$p~"
diff -Nurad guilt-0.27~/guilt-header guilt-0.27/guilt-header
--- guilt-0.27~/guilt-header	2007-08-01 21:01:21.000000000 +0200
+++ guilt-0.27/guilt-header	2007-10-06 12:42:20.000000000 +0200
@@ -6,6 +6,10 @@
 USAGE="[-e] [<patchname>]"
 . `dirname $0`/guilt
 
+TMP_LOG="$(mktemp /tmp/guilt.log.XXXXXXXXXXXXXXX || exit 1)"
+TMP_MSG="$(mktemp /tmp/guilt.msg.XXXXXXXXXXXXXXX || exit 1)"
+TMP_DIFF="$(mktemp /tmp/guilt.diff.XXXXXXXXXXXXXXX || exit 1)"
+
 case $# in
 	0)
 		patch=`get_top`
@@ -41,13 +45,13 @@
 if [ -z "$edit" ]; then
 	do_get_header "$GUILT_DIR/$branch/$patch"
 else
-	do_get_full_header "$GUILT_DIR/$branch/$patch" > /tmp/guilt.msg.$$
-	do_get_patch "$GUILT_DIR/$branch/$patch" > /tmp/guilt.diff.$$
+	do_get_full_header "$GUILT_DIR/$branch/$patch" > "$TMP_MSG"
+	do_get_patch "$GUILT_DIR/$branch/$patch" > "$TMP_DIFF"
 	$editor "/tmp/guilt.msg.$$"
 	mv "$GUILT_DIR/$branch/$patch" "$GUILT_DIR/$branch/$patch~"
 
 	(
-		cat /tmp/guilt.msg.$$
-		cat /tmp/guilt.diff.$$
+		cat "$TMP_MSG"
+		cat "$TMP_DIFF"
 	) > "$GUILT_DIR/$branch/$patch"
 fi

pgpFZiFfSyZsf.pgp
Description: PGP signature