tempnam bug

[Antti Louko]

Just found this in public Reno distribution:

src/lib/libc/gen/tmpnam.c, function tempnam()

...
	if (f = getenv("TMPDIR")) {
		(void)sprintf(name, "%s/%sXXXXXX", f, pfx ? "" : pfx);
		if (f = mktemp(name))
			return(f);
	}
	if (dir) {
		(void)sprintf(name, "%s/%sXXXXXX", dir, pfx ? "" : pfx);
		if (f = mktemp(name))
			return(f);
	}
	(void)sprintf(name, "%s/%sXXXXXX", P_tmpdir, pfx ? "" : pfx);
	if (f = mktemp(name))
		return(f);
	(void)sprintf(name, "/tmp/%sXXXXXX", pfx ? "" : pfx);
	if (!(f = mktemp(name)))
		(void)free(name);
...

This should of course be:

...
	if (f = getenv("TMPDIR")) {
		(void)sprintf(name, "%s/%sXXXXXX", f, pfx ? pfx : "");
		if (f = mktemp(name))
			return(f);
	}
	if (dir) {
		(void)sprintf(name, "%s/%sXXXXXX", dir, pfx ? pfx : "");
		if (f = mktemp(name))
			return(f);
	}
	(void)sprintf(name, "%s/%sXXXXXX", P_tmpdir, pfx ? pfx : "");
	if (f = mktemp(name))
		return(f);
	(void)sprintf(name, "/tmp/%sXXXXXX", pfx ? pfx : "");
	if (!(f = mktemp(name)))
		(void)free(name);
...

This can cause very interesting bugs for programs using different temp
files.

	Antti Louko (alo at hut.fi)
	Helsinki University of Technology
	Computing Centre