Re: C vs. Ada - strings

[Florian Weimer <Florian.Weimer@RUS.Uni-Stuttgart.DE>]

Robert Dewar <robert_dewar@my-deja.com> writes:

[Don't use tmpfile()]

> Now there's FUD if I ever saw it!

Certainly it is, but it is appropriate in this case, I think.

For example, the GNU/Linux implementation of tmpfile() had a race
condition which permitted every local user to open the temporary file,
and this bug was not fixed until GNU libc 2.0.6 (and it is still there
in libc4/libc5).  This bug is very hard to spot on a running system
(unless someone is actually exploiting it or you have a system call
logger), and obviously, nobody looked at the source code.

> To the extent that this is an effective argument, it can
> presumably be used for all xxxx :-)

The temporary file generation functions are very critical, many
security breaches (by local users) are due to insecure temporary
files.  The problem is very subtle, and you can tell a broken
implementation from a correct one only by looking at the source code
or at a verbose system call trace.  In fact, I believe that tmpfile()
is implemented wrong on a number of additional platforms, but I
couldn't check because I neither have source code nor a system call
tracer for these platforms!

-- 
Florian Weimer 	                  Florian.Weimer@RUS.Uni-Stuttgart.DE
University of Stuttgart           http://cert.uni-stuttgart.de/
RUS-CERT                          +49-711-685-5973/fax +49-711-685-5898
http://ca.uni-stuttgart.de:11371/pks/lookup?op=get&search=0xC06EC3B5