On Thu, Nov 14, 2013 at 04:46:57AM -0800, Martin Nowak wrote:
> > @@ -462,6 +462,21 @@ int runLINK()
> >      {
> >          argv.push(global.params.exefile);
> >      }
> > +    else if (global.params.run)
> > +    {
> > +        /* The use of tmpnam raises the issue of "is this a security hole"?
> > +         * The hole is that after tmpnam and before the file is opened,
> > +         * the attacker modifies the file system to get control of the
> > +         * file with that name. I do not know if this is an issue in
> > +         * this context.
> > +         * We cannot just replace it with mkstemp, because this name is
> > +         * passed to the linker that actually opens the file and writes to it.
> > +         */
> > +        char s[L_tmpnam + 1];
> > +        char *n = tmpnam(s);
> 
> The filename of the created tempfile is returned in the name parameter.
> After closing the file we can reuse the name without a race.
> http://linux.die.net/man/3/mkstemp
> I don't see any security issue here at all because the linker simply writes to the file.

Ahhh, right, somehow I was mixing up mkstemp with tmpfile(), for which
you can't get the name and is automatically removed when you close it...

Using mkstemp() seems sensible then...