blob: b0a0fe4677af5712a1a87dde1a8f151b7c2732e3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
Fix insecure use of temporary files.
Patch from upstream bzr, backported to Emacs 24.3.
https://bugs.gentoo.org/509830
CVE-2014-3423
revno: 117087
fixes bug: http://debbugs.gnu.org/17428
committer: Glenn Morris <rgm@gnu.org>
branch nick: emacs-24
timestamp: Thu 2014-05-08 14:10:36 -0400
message:
* browse-url.el (browse-url-mosaic): Be careful when writing /tmp/Mosaic.PID.
--- emacs-24.3-orig/lisp/net/browse-url.el
+++ emacs-24.3/lisp/net/browse-url.el
@@ -1328,28 +1328,26 @@
(let ((pidfile (expand-file-name browse-url-mosaic-pidfile))
pid)
(if (file-readable-p pidfile)
- (save-excursion
- (find-file pidfile)
- (goto-char (point-min))
- (setq pid (read (current-buffer)))
- (kill-buffer nil)))
- (if (and pid (zerop (signal-process pid 0))) ; Mosaic running
- (save-excursion
- (find-file (format "/tmp/Mosaic.%d" pid))
- (erase-buffer)
- (insert (if (browse-url-maybe-new-window new-window)
- "newwin\n"
- "goto\n")
- url "\n")
- (save-buffer)
- (kill-buffer nil)
+ (with-temp-buffer
+ (insert-file-contents pidfile)
+ (setq pid (read (current-buffer)))))
+ (if (and (integerp pid) (zerop (signal-process pid 0))) ; Mosaic running
+ (progn
+ (with-temp-buffer
+ (insert (if (browse-url-maybe-new-window new-window)
+ "newwin\n"
+ "goto\n")
+ url "\n")
+ (if (file-exists-p (setq pidfile (format "/tmp/Mosaic.%d" pid)))
+ (delete-file pidfile))
+ ;; http://debbugs.gnu.org/17428. Use O_EXCL.
+ (write-region nil nil pidfile nil 'silent nil 'excl))
;; Send signal SIGUSR to Mosaic
(message "Signaling Mosaic...")
(signal-process pid 'SIGUSR1)
;; Or you could try:
;; (call-process "kill" nil 0 nil "-USR1" (int-to-string pid))
- (message "Signaling Mosaic...done")
- )
+ (message "Signaling Mosaic...done"))
;; Mosaic not running - start it
(message "Starting %s..." browse-url-mosaic-program)
(apply 'start-process "xmosaic" nil browse-url-mosaic-program
|
GitWeb
