Both packageslave.cpp and textedit.cpp have instances of possibly exploitable

race conditions associated to files. The big deal is that it is quite typical
to use strings of pathnames to track files. But because that does not leverage
the filesystem would be attackers may be able to exploit time lags in uses
of filesystem functions (like stat and chmod or open) to get files with
suspect data into the files that the applications are working with.

This commit closes that potential hole even though there are no known exploits.
Better safe then sorry. There is no change in the behavior of the apps.

1 files changed, 3 insertions, 6 deletions

diff --git a/core/apps/textedit/textedit.cpp b/core/apps/textedit/textedit.cpp
index 4bbc62b..1c81a55 100644
--- a/core/apps/textedit/textedit.cpp
+++ b/core/apps/textedit/textedit.cpp
@@ -741,147 +741,144 @@ void TextEdit::openFile( const QString &f ) {
     name = name.mid( sep+1 );
   updateCaption( name );
 }
 
 void TextEdit::openFile( const DocLnk &f ) {
 //    clear();
 //    bFromDocView = true;
     FileManager fm;
     QString txt;
     currentFileName=f.file();
     odebug << "openFile doclnk " + currentFileName << oendl;
     if ( !fm.loadFile( f, txt ) ) {
           // ####### could be a new file
         odebug << "Cannot open file" << oendl;
     }
 //    fileNew();
     if ( doc )
         delete doc;
     doc = new DocLnk(f);
     editor->setText(txt);
     editor->setEdited( false);
     edited1=false;
     edited=false;
 
     doc->setName(currentFileName);
     updateCaption();
     setTimer();
 }
 
 void TextEdit::showEditTools() {
     menu->show();
     editBar->show();
     if(!useSearchBar)
         searchBar->hide();
     else
         searchBar->show();
     setWState (WState_Reserved1 );
 }
 
 /*!
   unprompted save */
 bool TextEdit::save() {
                 QString name, file;
     odebug << "saveAsFile " + currentFileName << oendl;
     if(currentFileName.isEmpty()) {
         saveAs();
         return false;
     }
-                name = currentFileName;
                 if(doc) {
                                 file = doc->file();
                                 odebug << "saver file "+file << oendl;
                                 name = doc->name();
                                 odebug << "File named "+name << oendl;
                 } else {
                                 file = currentFileName;
         name = QFileInfo(currentFileName).baseName();
                  }
 
     QString rt = editor->text();
     if( !rt.isEmpty() ) {
         if(name.isEmpty()) {
             saveAs();
         } else {
             currentFileName = name;
             odebug << "saveFile "+currentFileName << oendl;
 
             struct stat buf;
             mode_t mode;
-            stat(file.latin1(), &buf);
+            QFile f(file);
+            fstat(f.handle(), &buf);
             mode = buf.st_mode;
 
             if(!fileIs) {
                 doc->setName( name);
                 FileManager fm;
                 if ( !fm.saveFile( *doc, rt ) ) {
                                                                                 QMessageBox::message(tr("Text Edit"),tr("Save Failed"));
                     return false;
                 }
             } else {
                 odebug << "regular save file" << oendl;
-                QFile f(file);
                                                                 if( f.open(IO_WriteOnly)) {
                                                                                 QCString crt = rt.utf8();
                                                                                 f.writeBlock(crt,crt.length());
                                                                 } else {
                                                                                 QMessageBox::message(tr("Text Edit"),tr("Write Failed"));
                                                                                 return false;
                                                                 }
-
             }
             editor->setEdited( false);
             edited1=false;
             edited=false;
             if(caption().left(1)=="*")
                                                                 setCaption(caption().right(caption().length()-1));
 
-
-            chmod( file.latin1(), mode);
+            fchmod( f.handle(), mode);
         }
         return true;
     }
     return false;
 }
 
 /*!
   prompted save */
 bool TextEdit::saveAs() {
 
     if(caption() == tr("Text Editor"))
         return false;
     odebug << "saveAsFile " + currentFileName << oendl;
 
     QString rt = editor->text();
     odebug << currentFileName << oendl;
 
     if( currentFileName.isEmpty()
         || currentFileName == tr("Unnamed")
         || currentFileName == tr("Text Editor"))
     {
         odebug << "do silly TT filename thing" << oendl;
         QString pt = rt.simplifyWhiteSpace();
         int i = pt.find( ' ' );
         QString docname = pt;
         if ( i > 0 ) docname = pt.left( i );
 
         while( docname.startsWith( "." ) )
             docname = docname.mid( 1 );
         docname.replace( QRegExp("/"), "_" );
         // Cut the length. Filenames longer than 40 are not helpful
         // and something goes wrong when they get too long.
         if ( docname.length() > 40 ) docname = docname.left(40);
 
         if ( docname.isEmpty() ) docname = tr("Unnamed");
 
         if(doc) doc->setName(docname);
 
         currentFileName=docname;
     }
 
 
     QMap<QString, QStringList> map;
     map.insert(tr("All"), QStringList() );
     QStringList text;
     text << "text/*";
     map.insert(tr("Text"), text );
     text << "*";