Security fix.

diff --git a/Makefile b/Makefile
index 18bd3136ac793bf78686601107bcc3364fa95b7a..0e5b9f29defe8a25f68fd1b35cd0384444cd41d8 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,6 @@
 # Makefile for the cstrings tool by Eric S. Raymond
 
-# Note: When the version changes, you also have to change the RPM spec file.
-VERS=2.2
+VERS=$(shell sed <cstrings.spec -n -e '/Version: \(.*\)/s//\1/p')
 
 CFLAGS=-O
 LDFLAGS=-s
@@ -38,13 +37,3 @@ cstrings-$(VERS).tar.gz: $(SOURCES) cstrings.1
        @(cd ..; rm cstrings-$(VERS))
 
 dist: cstrings-$(VERS).tar.gz
-
-RPMROOT=/usr/src/redhat
-RPM = rpm
-RPMFLAGS = -ba
-rpm: dist
-       cp cstrings-$(VERS).tar.gz $(RPMROOT)/SOURCES;
-       cp cstrings.spec $(RPMROOT)/SPECS
-       cd $(RPMROOT)/SPECS; $(RPM) $(RPMFLAGS) cstrings.spec   
-       cp $(RPMROOT)/RPMS/`arch|sed 's/i[4-9]86/i386/'`/cstrings-$(VERS)*.rpm .
-       cp $(RPMROOT)/SRPMS/cstrings-$(VERS)*.src.rpm .

diff --git a/cstrings.l b/cstrings.l
index dfcf1f80ca42d14c921aeb7aeb5b448acff31445..013b0f49f81a91cd70c7ce1783e9c0483e2ff081 100644 (file)
--- a/cstrings.l
+++ b/cstrings.l
@@ -5,6 +5,7 @@
  * by Eric S. Raymond <esr@snark.thyrsus.com>, July 10 1990
  *
  * version 2.0, November 15 1993 -- strict ANSI/POSIX conformance.
+ * version 2.3, December 29 2003 -- remplace tempnam(3) with mkstemp(3)
  */
 #include <unistd.h>
 #include <stdio.h>
@@ -282,7 +283,8 @@ char *argv[];
                (void) strcat(buf, argv[optind]);
                if (cp = strrchr(buf, '/'))
                    *cp = '\0';
-               if ((tf = tempnam(buf, "cstr")) == (char *)NULL)
+               strcpy(buf, "cstrXXXXXX");
+               if (mkstemp(buf))
                {
                    perror("cstrings, making tempfile");
                    exit(1);

diff --git a/cstrings.spec b/cstrings.spec
index 5bd34c406ae194e8950df2d9bab4b27ce5444ad8..a63016787f430bc5f25fed6ddfbbc196951c3b34 100644 (file)
--- a/cstrings.spec
+++ b/cstrings.spec
@@ -1,27 +1,47 @@
 Name: cstrings 
-Version: 2.2
+Version: 2.3
 Release: 1
-URL: http://www.tuxedo.org/~esr/
+URL: http://www.catb.org/~esr/cstrings/
 Source0: %{name}-%{version}.tar.gz
 License: GPL
 Group: Development/Tools
 Summary: quick-and-dirty C code internationalization tool
+BuildRoot: %{_tmppath}/%{name}-root
 
 %description
-A quick-and-dirty internationalization tool for C code.  Extracts
-strings from a program and turns them into #defines in a pre-pended
-code section.  Has good features for incremental use.
+A lightweight internationalization tool for C code, for those who find
+gettext too bulky and intrusive.  Extracts strings from a program and
+turns them into #defines in a pre-pended code section.  Has good
+features for building up your message base incrementally.
 
 %prep
-%setup
+%setup -q
 
 %build
 make
+make cstrings.1
 
 %install
-make install
+[ "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT"
+mkdir -p "$RPM_BUILD_ROOT"/usr/bin
+mkdir -p "$RPM_BUILD_ROOT"/usr/share/man/man1/
+cp cstrings "$RPM_BUILD_ROOT"/usr/bin
+cp cstrings.1 "$RPM_BUILD_ROOT"/usr/share/man/man1/
+
+%clean
+[ "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT"
 
 %files
-/usr/share/man/man1/cstrings.1
-/usr/bin/cstrings
 %doc READ.ME COPYING
+%{_bindir}/cstrings
+%{_mandir}/man1/cstrings.1*
+
+%changelog
+* Mon Dec 29 2003 Eric S. Raymond <esr@snark.thyrsus.com> 2.3-1
+- Use mkstemp(3) rather than tempnam(3) for security's sake.
+- Source RPMs no longer depend on --define myversion.
+
+* Wed Dec 24 2003 Eric S. Raymond <esr@snark.thyrsus.com> 2.2
+- Fixed RPM packaging.
+
+