On Thu, Nov 14, 2013 at 01:21:44AM -0800, Martin Nowak wrote:
> > @@ -462,6 +462,21 @@ int runLINK()
> >      {
> >          argv.push(global.params.exefile);
> >      }
> > +    else if (global.params.run)
> > +    {
> > +        /* The use of tmpnam raises the issue of "is this a security hole"?
> > +         * The hole is that after tmpnam and before the file is opened,
> > +         * the attacker modifies the file system to get control of the
> > +         * file with that name. I do not know if this is an issue in
> > +         * this context.
> > +         * We cannot just replace it with mkstemp, because this name is
> > +         * passed to the linker that actually opens the file and writes to it.
> > +         */
> > +        char s[L_tmpnam + 1];
> > +        char *n = tmpnam(s);
> 
> The race condition between multiple processes is still a problem.
> You can use `char name[] = P_tmpdir"/dmd_runXXXXXX"; int fd = mkstemp(name); close(fd);` on Posix and something like [GetTempFileName](http://msdn.microsoft.com/en-us/library/windows/desktop/aa364991(v=vs.85).aspx) on Windows.

For POSIX, I don't see how this fix the race condition or how can you
get the file name at all, which is what you really need.