2008-04-18 Steve Grubb <sgrubb@redhat.com> (tiny change)

	* vcdiff: Use mktemp (CVE-2008-1694).

diff --git a/lib-src/ChangeLog b/lib-src/ChangeLog
index 2ed5830d550e2a02c0f382065e0bfee6e53b8381..63cc416cad745c957b3c523efe3f486a73eb79cb 100644 (file)
--- a/lib-src/ChangeLog
+++ b/lib-src/ChangeLog
@@ -1,3 +1,7 @@
+2008-04-18  Steve Grubb  <sgrubb@redhat.com>  (tiny change)
+
+       * vcdiff: Use mktemp (CVE-2008-1694).
+
 2008-04-10  Jason Rumney  <jasonr@gnu.org>
 
        * makefile.w32-in (CLIENTRES): New variable and target.

diff --git a/lib-src/vcdiff b/lib-src/vcdiff
index 86b80bcdacda3005c209c6ce104a5997ccec083a..cb977709db013f130a96edf7ca5cd80facc558fd 100755 (executable)
--- a/lib-src/vcdiff
+++ b/lib-src/vcdiff
@@ -84,14 +84,14 @@ do
        case $f in
        s.* | */s.*)
                if
-                       rev1=/tmp/geta$$
+                       rev1=`mktemp /tmp/geta.XXXXXXXX`
                        get -s -p -k $sid1 "$f" > $rev1 &&
                        case $sid2 in
                        '')
                                workfile=`expr " /$f" : '.*/s.\(.*\)'`
                                ;;
                        *)
-                               rev2=/tmp/getb$$
+                               rev2=`mktemp /tmp/getb.XXXXXXXX`
                                get -s -p -k $sid2 "$f" > $rev2
                                workfile=$rev2
                        esac