Re: CVS commit: pkgsrc/sysutils/gentoo

["OBATA Akio" <obache%netbsd.org@localhost>]

On Mon, 26 Jan 2009 13:44:56 +0900, David Holland 
<dholland-pkgchanges%netbsd.org@localhost> wrote:

> On Mon, Jan 26, 2009 at 10:12:43AM +0900, OBATA Akio wrote:
>  > > This is incorrect - you've introduced insecure-temporary-files.
>  > >
>  > > Please put patch-ae back, and revise it to use mkstemp() instead of
>  > > mkdtemp(). Perhaps something like this (untested):
>  >
>  > patch-ae was broken, and I don't think it is so insecure
>  > (maybe, should pass O_EXCL to open though).
>
> Not just maybe. It's fully insecure this way.
>
>  > If you think this issue should be fixed, please.
>
> I don't have time to do it right, but I'll commit what I've got. If it
> turns out not to work, we're no worse off than with the mkdtemp().

Just reported to upstream:
https://sourceforge.net/tracker/?func=detail&atid=406763&aid=2537314&group_id=32880

-- 
"Of course I love NetBSD":-)
OBATA Akio / obache%NetBSD.org@localhost