On 2026/03/23 14:38, Stuart Henderson wrote:
> > +- strcpy (tmp_filename, "/tmp/gnat-XXXXXX");
> > ++ assert(strlcpy (tmp_filename, "/tmp/gnat-XXXXXX",
> > ++ __gnat_max_path_len) < (unsigned int)
> > __gnat_max_path_len);
> > + #endif
> > + else
> > +- sprintf (tmp_filename, "%s/gnat-XXXXXX", tmpdir);
> > ++ assert(snprintf (tmp_filename, __gnat_max_path_len,
> > ++ "%s/gnat-XXXXXX", tmpdir) < __gnat_max_path_len);
> > +
> > + close (mkstemp(tmp_filename));
>
> am I being stupid or is this code totally broken?
posix says this (which we do)...
"The mkstemp() function shall replace the contents of the string pointed
to by template by a unique filename, and return a file descriptor for
the file open for reading and writing"
so this is a) not actually broken but b) wtf?!
I suppose it does ensure that the file is created with correct
ownership, though it seems like a case where the last paragraph of
our mktemp(3) EXAMPLES might be a better choice
