PHP 4.0 Bug #5744 Updated: tempnam() possibly used unsafely

ID: 5744 Updated by: joey Reported By: cahagn_o@epita.fr Status: Assigned Bug Type: Compile Warning Assigned To: joey Comments: This will require some kind of major changes. man mkstemp says: Don't use this function, use tmpfile(3) instead. It's better defined and more portable. The problem is that tmpfile returns a file descriptor to an already opened file, which is not what is expected by these portions of code. Previous Comments: [2000-09-05 07:25:38] cahagn_o@epita.fr With snaphost php4-200009050245, reflecting Zeev's security fixes, the warnings changed a bit (the lines are different, that's all): file.c:595: warning: tempnam() possibly used unsafely, consider using mkstemp() rfc1867.c:329: warning: tempnam() possibly used unsafely, consider using mkstemp() --------------------------------------------------------------------------- [2000-09-04 20:27:26] sniper@php.net Is this still happening with latest CVS?? --Jani --------------------------------------------------------------------------- [2000-07-23 12:12:58] cahagn_o@epita.fr Hi, I already talked about that in php-dev but got no answer. So I submit this as a bug report. Since I compile PHP4 Beta1 to latest snapshop (July 23rd), the final step (when linking php) shows: file.c:599: warning: tempnam() possibly used unsafely, consider using mkstemp() rfc1867.c:284: warning: tempnam() possibly used unsafely, consider using mkstemp() I don't know if this important in this case, but as I saw many bugs on Bugtraq with tempnam(), I thought I'd submit it anyway. I'm using NetBSD 1.3.3 x86 with gcc-2.7.2.2+myc2 and my ./configure is: ./configure --with-config-file-path=/space/www/etc/httpd/conf/php_cgi --enable-discard-path --with-gd=/u/guest/www/mbin/i386-NetBSD --with-mysql --with-dbase --with-zlib=/u/guest/www/mbin/i386-NetBSD --with-mcrypt=/u/guest/www/mbin/i386-NetBSD --with-mhash=/u/guest/www/mbin/i386-NetBSD --enable-ftp --enable-inline-optimization --with-jpeg-dir=/u/guest/www/mbin/i386-NetBSD --with-imap=/u/guest/www/mbin/i386-NetBSD/lib This warning does not happen with a standard RedHat 6.2 with egcs-2.91.66 19990314/Linux (egcs-1.1.2 release) --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=5744