Branch: v3.5.13-sru

efe195c0 2015-12-12 17:54:05 Slávek Banko
Fix security issue CVE-2015-7543
[taken from Debian arts patches]
(cherry picked from commit bbb70b9ed2ffa5d4ee98e94db0c8a0d19f60c5ed)
M mcop/mcoputils.cc
diff --git a/mcop/mcoputils.cc b/mcop/mcoputils.cc
index d28c640..a447b3b 100644
--- a/mcop/mcoputils.cc
+++ b/mcop/mcoputils.cc
@@ -307,7 +307,8 @@
      unlink(kde_tmp_dir.c_str());
      user_tmp_dir += "XXXXXX";
      tmp_buf = strdup(user_tmp_dir.c_str());
-     mktemp(tmp_buf); /* We want a directory, not a file, so using mkstemp makes no sense and is wrong */
+     if (mkdtemp(tmp_buf) == NULL)
+	 return 1;
      result = create_link(kde_tmp_dir.c_str(), tmp_buf);
      free(tmp_buf);
      return result;
@@ -347,7 +348,8 @@
      unlink(kde_tmp_dir.c_str());
      user_tmp_dir += "XXXXXX";
      tmp_buf = strdup(user_tmp_dir.c_str());
-     mktemp(tmp_buf); /* We want a directory, not a file, so using mkstemp makes no sense and is wrong */
+     if (mkdtemp(tmp_buf) == NULL)
+	 return 1;
      result = create_link(kde_tmp_dir.c_str(), tmp_buf);
      free(tmp_buf);
      return result;
@@ -358,7 +360,8 @@
   unlink(kde_tmp_dir.c_str());
   user_tmp_dir += "XXXXXX";
   tmp_buf = strdup(user_tmp_dir.c_str());
-  mktemp(tmp_buf); /* We want a directory, not a file, so using mkstemp makes no sense and is wrong */
+  if (mkdtemp(tmp_buf) == NULL)
+      return 1;
   result = create_link(kde_tmp_dir.c_str(), tmp_buf);
   free(tmp_buf);
   return result;