john-dev - office2john.c uses mktemp()

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120628204714.GA25173@openwall.com>
Date: Fri, 29 Jun 2012 00:47:14 +0400
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: office2john.c uses mktemp()

Dhiru, all -

I've just noticed this:

	dirname = mktemp(template);
	if (!dirname) {
		perror("mkdtemp");
		exit(-1);
	}
	outfile = gsf_outfile_stdio_new(dirname, &err);
	if (outfile == NULL) {

I hope gsf_outfile_stdio_new() will return NULL if the directory name is
already taken, so this is not a security hole then (otherwise it is!),
but even if so this has two issues:

1. mktemp() is deprecated, to the point that some systems will give
scary warnings and some might not even provide the function.

2. In the perror() call, it says "mkdtemp", whereas the function that
was actually called was mktemp().

Do you see an easy fix for this?  If so, please propose one in here
first, don't commit any fix right away.

Thanks,

Alexander

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.