Menu

#126 5.1.7 testsuite writes to predefined name in world writeable directory

v1.0_(example)
closed
nobody
None
1
2019-03-17
2019-03-17
No

Hello,

the testsuite writes directly to fixed filenames in /tmp like /tmp/regress. Since the respective commands follow symlinks this not just offers an easy way to break other user's building giflib but also allow to overwrite their files.
ln -s /var/mail/alice /tmp/regress

Also the same filename is used for multiple targets in tests/makefile which breaks parallel building.

possible patch attached.

cu Andreas

1 Attachments

Discussion

  • Eric S. Raymond

    Eric S. Raymond - 2019-03-17

    Patch tested, accepted, and pushed.

     
  • Eric S. Raymond

    Eric S. Raymond - 2019-03-17
    • status: open --> closed
     

Log in to post a comment.