@@ -1,3 +1,9 @@

+Tue May 29 21:21:09 CEST 2007 (tk)

+----------------------------------

+  * libclamav/others.c: use strict permissions (0600) for temporary files

+			created in cli_gentempstream() (bb#517)

+			Reported by Christoph Probst

+

 Tue May 29 17:42:12 CEST 2007 (tk)

 ----------------------------------

   * libclamav/ole2_extract.c: detect block list loop (bb#466), patch from Trog

@@ -551,16 +551,22 @@ char *cli_gentempdesc(const char *dir, int *fd)

 char *cli_gentempstream(const char *dir, FILE **fs)

 {

 	char *name;

+	mode_t omask;

+

     name = cli_gentempname(dir);

+    if(!name)

+	return NULL;

-    if(name && ((*fs = fopen(name, "wb+")) == NULL)) {

+    omask = umask(077);

+    if((*fs = fopen(name, "wb+")) == NULL) {

 	cli_dbgmsg("cli_gentempstream(): can't create temp file: %s\n", name);

         free(name);

         name = NULL;

     }

+    umask(omask);

-    return(name);

+    return name;

 }

 #ifdef	C_WINDOWS