summaryrefslogtreecommitdiff
path: root/lib/libc/stdio
diff options
context:
space:
mode:
authoryamt <yamt@NetBSD.org>2002-08-10 16:34:29 +0000
committeryamt <yamt@NetBSD.org>2002-08-10 16:34:29 +0000
commite7d9fe95ae3a9dacfa11b524dbf103f2fb80519d (patch)
tree3731155c626f0e356d052aa0da28e5a918e155d8 /lib/libc/stdio
parent16a190bb23226d3c275cf193a350e73c72c78e52 (diff)
- add description of the race.
- fix typo. from OpenBSD.
Diffstat (limited to 'lib/libc/stdio')
-rw-r--r--lib/libc/stdio/tmpnam.321
1 files changed, 17 insertions, 4 deletions
diff --git a/lib/libc/stdio/tmpnam.3 b/lib/libc/stdio/tmpnam.3
index 25682f3ff56..1591bff8b8f 100644
--- a/lib/libc/stdio/tmpnam.3
+++ b/lib/libc/stdio/tmpnam.3
@@ -1,4 +1,4 @@
-.\" $NetBSD: tmpnam.3,v 1.9 2002/02/07 07:00:27 ross Exp $
+.\" $NetBSD: tmpnam.3,v 1.10 2002/08/10 16:34:29 yamt Exp $
.\"
.\" Copyright (c) 1988, 1991, 1993
.\" The Regents of the University of California. All rights reserved.
@@ -37,7 +37,7 @@
.\"
.\" @(#)tmpnam.3 8.2 (Berkeley) 11/17/93
.\"
-.Dd March 24, 1997
+.Dd August 11, 2002
.Dt TMPFILE 3
.Os
.Sh NAME
@@ -142,7 +142,7 @@ on error.
The
.Fn tmpnam
and
-.Fn tempfile
+.Fn tempnam
functions
return a pointer to a file name on success, and a
.Dv NULL
@@ -202,7 +202,20 @@ with the historic
.Xr mktemp 3
interface).
First, there is an obvious race between file name selection and file
-creation and deletion.
+creation and deletion: the program is typically written to call
+.Fn tmpnam Ns ,
+.Fn tmpname Ns , or
+.Xr mktemp 3 .
+Subsequently, the program calls
+.Xr open 2
+or
+.Xr fopen 3
+and erroneously opens a file (or symbolic link, or fifo or other
+device) that the attacker has placed in the expected file location.
+Hence
+.Xr mkstemp 3
+is recommended, since it atomically creates the file.
+.Pp
Second, most historic implementations provide only a limited number
of possible temporary file names (usually 26) before file names will
start being recycled.