diff options
author | Joachim Schrod <jschrod@acm.org> | 2007-07-02 20:55:41 +0000 |
---|---|---|
committer | Joachim Schrod <jschrod@acm.org> | 2007-07-02 20:55:41 +0000 |
commit | 70d9dce6238727d0686b987b98005a46765a64f1 (patch) | |
tree | 52bd743d43a08da44a648777acee4097e7b59e2a /Build/source/texk/dviljk/ChangeLog | |
parent | 9551484d7cfbdd630209f91e685fe5be87b43bce (diff) |
Security issue: Repaired tempfile creation race condition.
Include file special parsing does not access unrelated variables
any more.
git-svn-id: svn://tug.org/texlive/trunk@4531 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/texk/dviljk/ChangeLog')
-rw-r--r-- | Build/source/texk/dviljk/ChangeLog | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/Build/source/texk/dviljk/ChangeLog b/Build/source/texk/dviljk/ChangeLog index 65354398eb6..51419944bb4 100644 --- a/Build/source/texk/dviljk/ChangeLog +++ b/Build/source/texk/dviljk/ChangeLog @@ -1,3 +1,14 @@ +2007-07-02 Joachim Schrod <jschrod@acm.org> + + * dvi2xx.c (DoSpecial): Security issue: usage of tmpnam() caused + tempfile race condition. I use mkdtemp() if it's available and + fall back to tmpnam. + + Special parsing of include files was inconsistent, unify it. The + current parsing code still allows lots of non-sensical special + commands, but at least it doesn't access unrelated variables any + more. + 2007-06-28 Joachim Schrod <jschrod@acm.org> * dvi2xx.c: Fixed a whole bunch of buffer overflows: The program |