Path: utzoo!utgpu!watserv1!watmath!att!news.cs.indiana.edu!samsung!uakari.primate.wisc.edu!crdgw1!rpi!uupsi!sunic!news.funet.fi!funic!santra!kampi.hut.fi!alo
From: alo@kampi.hut.fi (Antti Louko)
Newsgroups: comp.bugs.4bsd
Subject: tempnam bug
Message-ID: <1991Feb21.144840.9186@santra.uucp>
Date: 21 Feb 91 14:48:40 GMT
Sender: news@santra.uucp (Cnews - USENET news system)
Reply-To: alo@kampi.hut.fi (Antti Louko)
Organization: Helsinki University of Technology
Lines: 50

Just found this in public Reno distribution:

src/lib/libc/gen/tmpnam.c, function tempnam()

...
	if (f = getenv("TMPDIR")) {
		(void)sprintf(name, "%s/%sXXXXXX", f, pfx ? "" : pfx);
		if (f = mktemp(name))
			return(f);
	}
	if (dir) {
		(void)sprintf(name, "%s/%sXXXXXX", dir, pfx ? "" : pfx);
		if (f = mktemp(name))
			return(f);
	}
	(void)sprintf(name, "%s/%sXXXXXX", P_tmpdir, pfx ? "" : pfx);
	if (f = mktemp(name))
		return(f);
	(void)sprintf(name, "/tmp/%sXXXXXX", pfx ? "" : pfx);
	if (!(f = mktemp(name)))
		(void)free(name);
...

This should of course be:

...
	if (f = getenv("TMPDIR")) {
		(void)sprintf(name, "%s/%sXXXXXX", f, pfx ? pfx : "");
		if (f = mktemp(name))
			return(f);
	}
	if (dir) {
		(void)sprintf(name, "%s/%sXXXXXX", dir, pfx ? pfx : "");
		if (f = mktemp(name))
			return(f);
	}
	(void)sprintf(name, "%s/%sXXXXXX", P_tmpdir, pfx ? pfx : "");
	if (f = mktemp(name))
		return(f);
	(void)sprintf(name, "/tmp/%sXXXXXX", pfx ? pfx : "");
	if (!(f = mktemp(name)))
		(void)free(name);
...

This can cause very interesting bugs for programs using different temp
files.

	Antti Louko (alo@hut.fi)
	Helsinki University of Technology
	Computing Centre