From babe2e05592f0e8025061ffc97e387e2aa70c99b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Sat, 27 Aug 2022 00:46:29 +0200 Subject: tempfile: avoid directory cleanup race MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The temporary directory created by mks_tempfile_dt() is deleted by first deleting the file within, then truncating the filename strbuf and passing the resulting string to rmdir(2). When the cleanup routine is invoked concurrently by a signal handler we can end up passing the now truncated string to unlink(2), however, which could cause problems on some systems. Avoid that issue by remembering the directory name separately. This way the paths stay unchanged. A signal handler can still race with normal cleanup, but deleting the same files and directories twice is harmless. Reported-by: Jeff King Signed-off-by: René Scharfe Signed-off-by: Junio C Hamano --- tempfile.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tempfile.h') diff --git a/tempfile.h b/tempfile.h index d7804a214a..5b9e8743dd 100644 --- a/tempfile.h +++ b/tempfile.h @@ -82,7 +82,7 @@ struct tempfile { FILE *volatile fp; volatile pid_t owner; struct strbuf filename; - size_t directorylen; + char *directory; }; /* -- cgit v1.2.3