From ae25974de301ba1809f2d7f0219fcdd86d18cc1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Fri, 15 Jul 2022 05:58:50 +0200 Subject: mingw: avoid mktemp() in mkstemp() implementation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The implementation of mkstemp() for MinGW uses mktemp() and open() without the flag O_EXCL, which is racy. It's not a security problem for now because all of its callers only create files within the repository (incl. worktrees). Replace it with a call to our more secure internal function, git_mkstemp_mode(), to prevent possible future issues. Signed-off-by: René Scharfe Signed-off-by: Junio C Hamano --- compat/mingw.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) (limited to 'compat') diff --git a/compat/mingw.c b/compat/mingw.c index 41fc16310c..e92087acc6 100644 --- a/compat/mingw.c +++ b/compat/mingw.c @@ -1044,10 +1044,7 @@ char *mingw_mktemp(char *template) int mkstemp(char *template) { - char *filename = mktemp(template); - if (filename == NULL) - return -1; - return open(filename, O_RDWR | O_CREAT, 0600); + return git_mkstemp_mode(template, 0600); } int gettimeofday(struct timeval *tv, void *tz) -- cgit v1.2.1