Bug 136287 - devel/cvsadmin [patch] configure cvsadmin to use mkdtemp(3) instead of insecure work-around
Summary: devel/cvsadmin [patch] configure cvsadmin to use mkdtemp(3) instead of insecu...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Philip M. Gollucci
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-07-03 16:30 UTC by Klaus Aehlig
Modified: 2009-07-09 03:40 UTC (History)
0 users

See Also:


Attachments
patch-cvsadmin-mkdtemp (568 bytes, text/plain)
2009-07-03 16:30 UTC, Klaus Aehlig
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Klaus Aehlig 2009-07-03 16:30:08 UTC
The configure script provided with cvsadmin-1.0.3 does not recognise
that the host system provides mkdtemp(3); in fact, it does not even 
test for it. Therefore ${WRKSRC}/src/util.c uses an insecure (as 
admitted in the source code) work around to generate a temporary
directory instead of using mkdtemp(3).

Fix: Since all supported versions of FreeBSD (even all versions since 3.2) provide
mkdtemp(3), simply set HAVE_MKDTEMP manually in the post-configure phase. This
can be achieved by applying the following patch to the port.
How-To-Repeat: 
cd /usr/ports/devel/cvsadmin && make configure
and inspect ${WRKSRC}/config.h, reading ${WRKSRC}/src/util.c

alternatively,
cd /usr/ports/devel/cvsadmin && make build
and inspect ${WRKSRC}/src/util.o
Comment 1 Edwin Groothuis freebsd_committer 2009-07-03 16:30:21 UTC
Class Changed
From-To: sw-bug->maintainer-update

Fix category (submitter is maintainer) (via the GNATS Auto Assign Tool)
Comment 2 Philip M. Gollucci freebsd_committer 2009-07-08 04:23:03 UTC
Responsible Changed
From-To: freebsd-ports-bugs->pgollucci

I'll take it.
Comment 3 dfilter service freebsd_committer 2009-07-09 03:37:35 UTC
pgollucci    2009-07-09 02:37:20 UTC

  FreeBSD ports repository

  Modified files:
    devel/cvsadmin       Makefile 
  Log:
  - configure cvsadmin to use mkdtemp(3) instead of insecure work-around
  
  PR:             ports/136287
  Submitted by:   Klaus T Aehlig <aehlig@linta.de> (maintainer)
  
  Revision  Changes    Path
  1.16      +5 -3      ports/devel/cvsadmin/Makefile
_______________________________________________
cvs-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/cvs-all
To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
Comment 4 Philip M. Gollucci freebsd_committer 2009-07-09 03:37:37 UTC
State Changed
From-To: open->closed

Committed. Thanks!