mingw: avoid mktemp() in mkstemp() implementation
The implementation of mkstemp() for MinGW uses mktemp() and open() without the flag O_EXCL, which is racy. It's not a security problem for now because all of its callers only create files within the repository (incl. worktrees). Replace it with a call to our more secure internal function, git_mkstemp_mode(), to prevent possible future issues. Signed-off-by: René Scharfe <l.s.r@web.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
René Scharfe committed
Jul 15, 2022 at 05:58 UTC
ae25974de301ba1809f2d7f0219fcdd86d18cc1f
1 file changed
+1
-4
compat/mingw.c
+1
-4
@@ -1044,10 +1044,7 @@ char *mingw_mktemp(char *template)
1044
1045
int mkstemp(char *template)
1046
{
1047
- char *filename = mktemp(template);
1048
- if (filename == NULL)
1049
- return -1;
1050
- return open(filename, O_RDWR | O_CREAT, 0600);
1047
+ return git_mkstemp_mode(template, 0600);
1048
}
1049
1050
int gettimeofday(struct timeval *tv, void *tz)