When compiling binutils cross-support packages under OBS, rpmlint raises the following issues: mingw64-cross-binutils.x86_64: W: call-to-mktemp /usr/bin/x86_64-w64-mingw32-dllwrap mingw64-cross-binutils.x86_64: W: call-to-mktemp /usr/bin/x86_64-w64-mingw32-windres mingw64-cross-binutils.x86_64: W: call-to-mktemp /usr/x86_64-w64-mingw32/bin/dlltool This executable calls mktemp. As advised by the manpage (mktemp(3)), this function should be avoided. Some implementations are deeply insecure, and there is a race condition between the time of check and time of use (TOCTOU). See http://capec.mitre.org/data/definitions/29.html for details, and contact upstream to have this issue fixed.
Hi Ralf, Ah yes. These tools are using the choose_temp_base() function provided by libiberty, which in turn calls mktemp(). Fortunately libiberty also supplies a function called make_temp_file() which does basically the same thing. So I am testing a patch to replace occurrences of one with the other. Cheers Nick
The master branch has been updated by Nick Clifton <nickc@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f4492fb683013d7de6f4788df6deb24fed8671b4 commit f4492fb683013d7de6f4788df6deb24fed8671b4 Author: Nick Clifton <nickc@redhat.com> Date: Thu Sep 1 14:51:50 2022 +0100 dllwrap, windres and dlltools use mktemp, which should be avoided PR 29534 * dllwrap.c: Replace uses of choose_temp_base() with make_temp_file(). * dlltool.c: Likewise. * resrc.c: Likewise.
Patch applied.
(In reply to Nick Clifton from comment #3) > Patch applied. Thanks Nick. I think that https://sourceware.org/bugzilla/show_bug.cgi?id=17227 can also be closed now.