From 0d3c07cdee2ade448242930afe0fdaf73ce5da39 Mon Sep 17 00:00:00 2001 From: Juan RP Date: Sun, 26 Jul 2015 09:11:20 +0200 Subject: [PATCH] portableproplib/prop_object: fix an insecure temporary file (CID #62739). --- lib/portableproplib/prop_object.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/portableproplib/prop_object.c b/lib/portableproplib/prop_object.c index 0caa8313..5ef6cbb4 100644 --- a/lib/portableproplib/prop_object.c +++ b/lib/portableproplib/prop_object.c @@ -849,8 +849,12 @@ _prop_object_externalize_write_file(const char *fname, const char *xml, strcat(tname, PLISTTMP); #undef PLISTTMP - if ((fd = mkstemp(tname)) == -1) + myumask = umask(S_IXUSR|S_IRWXG|S_IRWXO); + if ((fd = mkstemp(tname)) == -1) { + umask(myymask); return (false); + } + umask(myymask); if (do_compress) { if ((gzf = gzdopen(fd, "a")) == NULL)