math/graphviz: New license and unsafe use of tmp files.

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

math/graphviz: New license and unsafe use of tmp files.

Sigfred Håversen

December 2004 Graphviz changed their license to Common Public License (CPL),
as may be seen: http://www.graphviz.org/News.php This should make it
less of a hassle to install it as it should not be needed to manually
agree to the (now old) license when building the port.

Graphviz uses tmp files in an unsafe way, and from the advisory
it seems the OpenBSD version might be vulnerable as well:

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2965

/Sigfred

Reply | Threaded
Open this post in threaded view
|

Re: math/graphviz: New license and unsafe use of tmp files.

Christian Weisgerber
Sigfred Håversen <[hidden email]> wrote:

> Graphviz uses tmp files in an unsafe way, and from the advisory
> it seems the OpenBSD version might be vulnerable as well:
>
> http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2965

This concerns only an _example_ script shipped with graphviz.  Also,
the upstream fix isn't all that secure (go from a single predictable
filename to 1 out of 10,000), see below.

If you know how to test "lefty" scripts, maybe you can provide a better
fix that uses mktemp(1)?  Or we simply ignore it.


--- dotty/dotty.lefty.orig Fri Feb 13 21:15:25 2004
+++ dotty/dotty.lefty Fri Oct 28 21:59:13 2005
@@ -668,7 +668,10 @@ dotty.protogt.printorsave = function (gt
         if (~(otype = ask ('print to', 'choice', 'file|printer')))
             return;
     if (otype == 'printer') {
-        name = '/tmp/dottyout.ps';
+        if (~getenv ('TMPDIR'))
+            name = concat (getenv ('HOME'), '/.dottyout.ps');
+        else
+            name = concat (getenv ('TMPDIR'), '/.dottyout.ps', random (10000));
         if (getenv ('LEFTYWINSYS') ~= 'mswin' & ~pr)
             if (~(pr = ask ('printer command', 'string', 'lpr')))
                 return;
@@ -768,5 +771,5 @@ dotty.protogt.printorsave = function (gt
     vt.canvas = canvas;
     destroywidget (pscanvas);
     if (otype == 'printer' & getenv ('LEFTYWINSYS') ~= 'mswin')
-        system (concat (pr, ' /tmp/dottyout.ps; rm /tmp/dottyout.ps'));
+        system (concat (pr, ' ', name, '; rm ',name));
 };
--
Christian "naddy" Weisgerber                          [hidden email]