bug#15522: gzcmp/gzdiff + gznew shell scripts use temporary files unsafely

2013-10-03 Thread Rich Burridge
Hi, We've had a bug reported against the version of gzip that we ship in Solaris: "The gzcmp and gzdiff (same script hardlinked) commands shipped with Solaris write to a file in the world writable directory '/tmp' if both of its arguments are compressed files. 'set -C' is used to ensure that

bug#15522: gzcmp/gzdiff + gznew shell scripts use temporary files unsafely

2013-10-03 Thread Rich Burridge
On 10/03/2013 06:47 PM, Paul Eggert wrote: Rich Burridge wrote: it would be better for these commands to use mktemp That was done in gzip 1.3.10, released 2006-12-30. Is this not working for you? If not, why not? I can see mktemp usage in gzexe.in and zdiff.in, but the Solaris bug report

bug#15522: gzcmp/gzdiff + gznew shell scripts use temporary files unsafely

2013-10-03 Thread Rich Burridge
On 10/03/2013 09:14 PM, Paul Eggert wrote: The zdiff usage of set -C is executed only on older platforms that lack mktemp, so it shouldn't be a problem. Okay. znew. What a dinosaur. It's hardly worth fixing, but I installed this: Excellent. We'll use a similar patch against the version w

bug#15522: gzcmp/gzdiff + gznew shell scripts use temporary files unsafely

2013-10-03 Thread Rich Burridge
On 10/03/2013 09:25 PM, Jim Meyering wrote: On Thu, Oct 3, 2013 at 7:37 PM, Rich Burridge wrote: ... Sorry, I probably confused things by giving their Solaris g names, and by stating that gzcmp and gzdiff were hard-linked without actually checking (because that's no longer true in the l