summaryrefslogtreecommitdiff
path: root/src/temp
AgeCommit message (Collapse)AuthorFilesLines
2022-10-19remove LFS64 symbol aliases; replace with dynamic linker remappingRich Felker4-7/+0
originally the namespace-infringing "large file support" interfaces were included as part of glibc-ABI-compat, with the intent that they not be used for linking, since our off_t is and always has been unconditionally 64-bit and since we usually do not aim to support nonstandard interfaces when there is an equivalent standard interface. unfortunately, having the symbols present and available for linking caused configure scripts to detect them and attempt to use them without declarations, producing all the expected ill effects that entails. as a result, commit 2dd8d5e1b8ba1118ff1782e96545cb8a2318592c was made to prevent this, using macros to redirect the LFS64 names to the standard names, conditional on _GNU_SOURCE or _LARGEFILE64_SOURCE. however, this has turned out to be a source of further problems, especially since g++ defines _GNU_SOURCE by default. in particular, the presence of these names as macros breaks a lot of valid code. this commit removes all the LFS64 symbols and replaces them with a mechanism in the dynamic linker symbol lookup failure path to retry with the spurious "64" removed from the symbol name. in the future, if/when the rest of glibc-ABI-compat is moved out of libc, this can be removed.
2022-06-23avoid limited space of random temp file names if clock resolution is lowRich Felker1-1/+1
this is not an issue that was actually hit, but I noticed it during previous changes to __randname: if the resolution of tv_nsec is too low, the space of temp file names obtainable by a thread could plausibly be exhausted. mixing in tv_sec avoids this.
2022-06-03remove random filename obfuscation that leaks ASLR informationRich Felker1-1/+2
the __randname function is used by various temp file creation interfaces as a backend to produce a name to attempt using. it does not have to produce results that are safe against guessing, and only aims to avoid unintentional collisions. mixing the address of an object on the stack in a reversible manner leaked ASLR information, potentially allowing an attacker who can observe the temp files created and their creation timestamps to narrow down the possible ASLR state of the process that created them. there is no actual value in mixing these addresses in; it was just obfuscation. so don't do it. instead, mix the tid, just to avoid collisions if multiple processes/threads stampede to create temp files at the same moment. even without this measure, they should not collide unless the clock source is very low resolution, but it's a cheap improvement. if/when we have a guaranteed-available userspace csprng, it could be used here instead. even though there is no need for cryptographic entropy here, it would avoid having to reason about clock resolution and such to determine whether the behavior is nice.
2018-09-12remove spurious inclusion of libc.h for LFS64 ABI aliasesRich Felker3-6/+3
the LFS64 macro was not self-documenting and barely saved any characters. simply use weak_alias directly so that it's clear what's being done, and doesn't depend on a header to provide a strange macro.
2018-09-12reduce spurious inclusion of libc.hRich Felker1-1/+0
libc.h was intended to be a header for access to global libc state and related interfaces, but ended up included all over the place because it was the way to get the weak_alias macro. most of the inclusions removed here are places where weak_alias was needed. a few were recently introduced for hidden. some go all the way back to when libc.h defined CANCELPT_BEGIN and _END, and all (wrongly implemented) cancellation points had to include it. remaining spurious users are mostly callers of the LOCK/UNLOCK macros and files that use the LFS64 macro to define the awful *64 aliases. in a few places, new inclusion of libc.h is added because several internal headers no longer implicitly include libc.h. declarations for __lockfile and __unlockfile are moved from libc.h to stdio_impl.h so that the latter does not need libc.h. putting them in libc.h made no sense at all, since the macros in stdio_impl.h are needed to use them correctly anyway.
2018-09-12overhaul internally-public declarations using wrapper headersRich Felker7-14/+0
commits leading up to this one have moved the vast majority of libc-internal interface declarations to appropriate internal headers, allowing them to be type-checked and setting the stage to limit their visibility. the ones that have not yet been moved are mostly namespace-protected aliases for standard/public interfaces, which exist to facilitate implementing plain C functions in terms of POSIX functionality, or C or POSIX functionality in terms of extensions that are not standardized. some don't quite fit this description, but are "internally public" interfacs between subsystems of libc. rather than create a number of newly-named headers to declare these functions, and having to add explicit include directives for them to every source file where they're needed, I have introduced a method of wrapping the corresponding public headers. parallel to the public headers in $(srcdir)/include, we now have wrappers in $(srcdir)/src/include that come earlier in the include path order. they include the public header they're wrapping, then add declarations for namespace-protected versions of the same interfaces and any "internally public" interfaces for the subsystem they correspond to. along these lines, the wrapper for features.h is now responsible for the definition of the hidden, weak, and weak_alias macros. this means source files will no longer need to include any special headers to access these features. over time, it is my expectation that the scope of what is "internally public" will expand, reducing the number of source files which need to include *_impl.h and related headers down to those which are actually implementing the corresponding subsystems, not just using them.
2018-09-12make mkostemps source file include the header for its declarationRich Felker1-0/+1
2014-10-06ignore access mode bits of flags in mkostemps and functions that use itRich Felker1-0/+1
per the text accepted for inclusion in POSIX, behavior is unspecified when any of the access mode bits are set. since it's impossible to consistently report this usage error (O_RDONLY could not be detected since its value happens to be zero), the most consistent way to handle them is just to ignore them. previously, if a caller erroneously passed O_WRONLY, the resulting access mode would be O_WRONLY|O_RDWR, which has the value 3, and this resulted in a file descriptor which rejects both read and write attempts when it is subsequently used.
2013-12-12include cleanups: remove unused headers and add feature test macrosSzabolcs Nagy3-8/+2
2013-09-04fix typo in comment in __randnameRich Felker1-1/+1
2013-08-02fix (deprecated) mktemp logic and update it to match other temp functionsRich Felker1-4/+11
the access function cannot be used to check for existence, because it operates using real uid/gid rather than effective to determine accessibility; this matters for the non-final path components. instead, use stat. failure of stat is success if only the final component is missing (ENOENT) and otherwise is failure.
2013-08-02remove (no longer useful) namespace-protected __mktemp symbolRich Felker1-4/+1
2013-08-02make mkdtemp and mkstemp family leave template unchanged on failRich Felker2-13/+18
also refactor mkdtemp based on new shared temp code, removing dependency on the deprecated mktemp, whose behavior made this logic more difficult.
2013-02-20use memcmp instead of str[n]cmp for temp function XXXXXX checkingRich Felker2-2/+2
2013-02-20fix error cases in mkostemps coreRich Felker1-6/+3
1. wrong return value and missing errno for negative suffix len 2. failure to catch suffix len > strlen 3. remove unwanted clearing of input string in invalid case
2013-02-20remove leftover unused variable in mktemp after refactoringRich Felker1-1/+0
2013-02-20add mkostemp, mkstemps, and mkostemps functions and reorganize temp internalsRich Felker6-29/+83
based on patch contributed by Anthony G. Basile (blueness) some issues remain with the filename generation algorithm and other small bugs, but this patch has been sitting around long enough that I feel it's best to get it committed and then work out any remaining issues.
2011-07-28remove ugly prng from mk*temp and just re-poll time on retryRich Felker1-6/+5
2011-07-28eliminate mk*temp dependency on snprintfRich Felker1-3/+4
this helps some tiny programs be even more tiny, and barly increases code size even if both are used.
2011-06-12another return value fix for mktemp...Rich Felker1-1/+2
2011-02-19make mktemp match the historic behavior, and update functions that use itRich Felker3-5/+8
the historic mktemp is supposed to blank the template string on failure, rather than returning 0. just zero the first character so that mkstemp and mkdtemp can still retry with O(1) space requirement.
2011-02-19fix major bug created from copying mkdtemp logicRich Felker1-1/+1
2011-02-18major improvements to temp file name generatorRich Felker3-16/+21
use current time in nanoseconds and some potentially-random (if aslr is enabled) pointer values for the initial tempfile name generation, and step via a cheap linear prng on collisions. limit the number of retry attempts to prevent denial of service attacks even if an attacker can guess the filenames.
2011-02-18reformat mkstemp like mkdtempRich Felker1-7/+5
this is cleaner and makes it easy to impose a limit on the number of retries later if it seems desirable to do so.
2011-02-14ensure standard functions mk[sd]temp don't depend on removed function mktempRich Felker3-5/+9
2011-02-14begin namespace-cleanup of standard C headersRich Felker2-0/+2
2011-02-12initial check-in, version 0.5.0v0.5.0Rich Felker3-0/+76