Bug 136287 - devel/cvsadmin [patch] configure cvsadmin to use mkdtemp(3) instead of insecure work-around
Summary: devel/cvsadmin [patch] configure cvsadmin to use mkdtemp(3) instead of insecu...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Philip M. Gollucci
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-07-03 16:30 UTC by Klaus Aehlig
Modified: 2009-07-09 03:40 UTC (History)
0 users

See Also:

Attachments
patch-cvsadmin-mkdtemp (568 bytes, text/plain)
2009-07-03 16:30 UTC, Klaus Aehlig 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Klaus Aehlig 2009-07-03 16:30:08 UTC 
The configure script provided with cvsadmin-1.0.3 does not recognise
that the host system provides mkdtemp(3); in fact, it does not even 
test for it. Therefore ${WRKSRC}/src/util.c uses an insecure (as 
admitted in the source code) work around to generate a temporary
directory instead of using mkdtemp(3).

Fix: Since all supported versions of FreeBSD (even all versions since 3.2) provide
mkdtemp(3), simply set HAVE_MKDTEMP manually in the post-configure phase. This
can be achieved by applying the following patch to the port.
How-To-Repeat: 
cd /usr/ports/devel/cvsadmin && make configure
and inspect ${WRKSRC}/config.h, reading ${WRKSRC}/src/util.c

alternatively,
cd /usr/ports/devel/cvsadmin && make build
and inspect ${WRKSRC}/src/util.o
Comment 1 Edwin Groothuis freebsd_committer freebsd_triage 2009-07-03 16:30:21 UTC 
Class Changed
From-To: sw-bug->maintainer-update

Fix category (submitter is maintainer) (via the GNATS Auto Assign Tool)
Comment 2 Philip M. Gollucci freebsd_committer freebsd_triage 2009-07-08 04:23:03 UTC 
Responsible Changed
From-To: freebsd-ports-bugs->pgollucci

I'll take it.
Comment 3 dfilter service freebsd_committer freebsd_triage 2009-07-09 03:37:35 UTC 
pgollucci    2009-07-09 02:37:20 UTC

  FreeBSD ports repository

  Modified files:
    devel/cvsadmin       Makefile 
  Log:
  - configure cvsadmin to use mkdtemp(3) instead of insecure work-around
  
  PR:             ports/136287
  Submitted by:   Klaus T Aehlig <aehlig@linta.de> (maintainer)
  
  Revision  Changes    Path
  1.16      +5 -3      ports/devel/cvsadmin/Makefile
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
Comment 4 Philip M. Gollucci freebsd_committer freebsd_triage 2009-07-09 03:37:37 UTC 
State Changed
From-To: open->closed

Committed. Thanks!