[pkgsrc/trunk]: pkgsrc/shells/zsh-current Fix an insecure temp file creation ...

[tonnerre <tonnerre%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/748b96df55c2
branches:  trunk
changeset: 544170:748b96df55c2
user:      tonnerre <tonnerre%pkgsrc.org@localhost>
date:      Sun Jul 13 18:26:24 2008 +0000

description:
Fix an insecure temp file creation vulnerability in zsh-current's difflog.pl
(CVE-2007-6209).

diffstat:

 shells/zsh-current/Makefile         |   4 ++--
 shells/zsh-current/distinfo         |   3 ++-
 shells/zsh-current/patches/patch-aa |  20 ++++++++++++++++++++
 3 files changed, 24 insertions(+), 3 deletions(-)

diffs (52 lines):

diff -r fd93e42e610c -r 748b96df55c2 shells/zsh-current/Makefile
--- a/shells/zsh-current/Makefile       Sun Jul 13 18:22:59 2008 +0000
+++ b/shells/zsh-current/Makefile       Sun Jul 13 18:26:24 2008 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.13 2007/11/07 09:59:27 bjs Exp $
+# $NetBSD: Makefile,v 1.14 2008/07/13 18:26:24 tonnerre Exp $
 
 .include "../../shells/zsh/Makefile.common"
 
-PKGREVISION=   1
+PKGREVISION=   2
 
 ZSH_VERSION=   4.3.4
 ZSH_MAINTAINER=        uebayasi%NetBSD.org@localhost
diff -r fd93e42e610c -r 748b96df55c2 shells/zsh-current/distinfo
--- a/shells/zsh-current/distinfo       Sun Jul 13 18:22:59 2008 +0000
+++ b/shells/zsh-current/distinfo       Sun Jul 13 18:26:24 2008 +0000
@@ -1,8 +1,9 @@
-$NetBSD: distinfo,v 1.11 2007/09/21 08:04:45 uebayasi Exp $
+$NetBSD: distinfo,v 1.12 2008/07/13 18:26:24 tonnerre Exp $
 
 SHA1 (zsh-4.3.4.tar.bz2) = 6bd905c4bf61bf3df5e5bb78f64be68366ad7517
 RMD160 (zsh-4.3.4.tar.bz2) = 2fe0fcf6371d2072c3b7eeae0392c7ef3665457c
 Size (zsh-4.3.4.tar.bz2) = 2374851 bytes
+SHA1 (patch-aa) = 15f9d45ea98f89945ca274fc5b0298fa9397f89d
 SHA1 (patch-ab) = 799e63e51338d542d6247066d77647365fda09c9
 SHA1 (patch-ac) = 95e15527e75685cbc140066efeec12127a4863ce
 SHA1 (patch-ae) = 62a763ee77b823d63f245f34122b232cf0344285
diff -r fd93e42e610c -r 748b96df55c2 shells/zsh-current/patches/patch-aa
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/shells/zsh-current/patches/patch-aa       Sun Jul 13 18:26:24 2008 +0000
@@ -0,0 +1,20 @@
+$NetBSD: patch-aa,v 1.7 2008/07/13 18:26:24 tonnerre Exp $
+
+--- Util/difflog.pl.orig       2002-04-18 16:35:17.000000000 +0200
++++ Util/difflog.pl
+@@ -2,10 +2,13 @@
+ 
+ use strict;
+ use IO::File;
++use File::Temp;
+ 
+ my @differ = qw(diff -bw);
+-my $oldtmp = "/tmp/difflog$$.old";
+-my $newtmp = "/tmp/difflog$$.new";
++my $oldf = new File::Temp(TEMPLATE => 'difflogXXXXX', DIR => '/tmp/', SUFFIX => '.old');
++my $newf = new File::Temp(TEMPLATE => 'difflogXXXXX', DIR => '/tmp/', SUFFIX => '.new');
++my $oldtmp = $oldf->filename;
++my $newtmp = $newf->filename;
+ 
+ my $newfn = pop(@ARGV);
+ my $oldfn = pop(@ARGV);