From: Eric S. Raymond <esr@thyrsus.com>
Date: Mon, 29 Dec 2003 08:23:39 +0000 (+0000)
Subject: Security fix.
X-Git-Tag: 2.3
X-Git-Url: http://thyrsus.com/gitweb/?a=commitdiff_plain;h=fa669a2b290d10f71b5ac2ea4f811c22500d1732;p=cstrings.git

Security fix.
---

diff --git a/Makefile b/Makefile
index 18bd313..0e5b9f2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,6 @@
 # Makefile for the cstrings tool by Eric S. Raymond
 
-# Note: When the version changes, you also have to change the RPM spec file.
-VERS=2.2
+VERS=$(shell sed <cstrings.spec -n -e '/Version: \(.*\)/s//\1/p')
 
 CFLAGS=-O
 LDFLAGS=-s
@@ -38,13 +37,3 @@ cstrings-$(VERS).tar.gz: $(SOURCES) cstrings.1
 	@(cd ..; rm cstrings-$(VERS))
 
 dist: cstrings-$(VERS).tar.gz
-
-RPMROOT=/usr/src/redhat
-RPM = rpm
-RPMFLAGS = -ba
-rpm: dist
-	cp cstrings-$(VERS).tar.gz $(RPMROOT)/SOURCES;
-	cp cstrings.spec $(RPMROOT)/SPECS
-	cd $(RPMROOT)/SPECS; $(RPM) $(RPMFLAGS) cstrings.spec	
-	cp $(RPMROOT)/RPMS/`arch|sed 's/i[4-9]86/i386/'`/cstrings-$(VERS)*.rpm .
-	cp $(RPMROOT)/SRPMS/cstrings-$(VERS)*.src.rpm .
diff --git a/cstrings.l b/cstrings.l
index dfcf1f8..013b0f4 100644
--- a/cstrings.l
+++ b/cstrings.l
@@ -5,6 +5,7 @@
  * by Eric S. Raymond <esr@snark.thyrsus.com>, July 10 1990
  *
  * version 2.0, November 15 1993 -- strict ANSI/POSIX conformance.
+ * version 2.3, December 29 2003 -- remplace tempnam(3) with mkstemp(3)
  */
 #include <unistd.h>
 #include <stdio.h>
@@ -282,7 +283,8 @@ char *argv[];
 		(void) strcat(buf, argv[optind]);
 		if (cp = strrchr(buf, '/'))
 		    *cp = '\0';
-		if ((tf = tempnam(buf, "cstr")) == (char *)NULL)
+		strcpy(buf, "cstrXXXXXX");
+		if (mkstemp(buf))
 		{
 		    perror("cstrings, making tempfile");
 		    exit(1);
diff --git a/cstrings.spec b/cstrings.spec
index 5bd34c4..a630167 100644
--- a/cstrings.spec
+++ b/cstrings.spec
@@ -1,27 +1,47 @@
 Name: cstrings 
-Version: 2.2
+Version: 2.3
 Release: 1
-URL: http://www.tuxedo.org/~esr/
+URL: http://www.catb.org/~esr/cstrings/
 Source0: %{name}-%{version}.tar.gz
 License: GPL
 Group: Development/Tools
 Summary: quick-and-dirty C code internationalization tool
+BuildRoot: %{_tmppath}/%{name}-root
 
 %description
-A quick-and-dirty internationalization tool for C code.  Extracts
-strings from a program and turns them into #defines in a pre-pended
-code section.  Has good features for incremental use.
+A lightweight internationalization tool for C code, for those who find
+gettext too bulky and intrusive.  Extracts strings from a program and
+turns them into #defines in a pre-pended code section.  Has good
+features for building up your message base incrementally.
 
 %prep
-%setup
+%setup -q
 
 %build
 make
+make cstrings.1
 
 %install
-make install
+[ "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT"
+mkdir -p "$RPM_BUILD_ROOT"/usr/bin
+mkdir -p "$RPM_BUILD_ROOT"/usr/share/man/man1/
+cp cstrings "$RPM_BUILD_ROOT"/usr/bin
+cp cstrings.1 "$RPM_BUILD_ROOT"/usr/share/man/man1/
+
+%clean
+[ "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT"
 
 %files
-/usr/share/man/man1/cstrings.1
-/usr/bin/cstrings
 %doc READ.ME COPYING
+%{_bindir}/cstrings
+%{_mandir}/man1/cstrings.1*
+
+%changelog
+* Mon Dec 29 2003 Eric S. Raymond <esr@snark.thyrsus.com> 2.3-1
+- Use mkstemp(3) rather than tempnam(3) for security's sake.
+- Source RPMs no longer depend on --define myversion.
+
+* Wed Dec 24 2003 Eric S. Raymond <esr@snark.thyrsus.com> 2.2
+- Fixed RPM packaging.
+
+