Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

remove insecure mktemp usage #4262

Merged
merged 1 commit into from Feb 6, 2014
Merged

Conversation

juliantaylor
Copy link
Contributor

mktemp only returns a filename, a malicous user could replace it before
it gets used.

os.unlink(tmpname)
with NamedTemporaryFile() as tmp:
fp = memmap(tmp.name, dtype=self.dtype, mode='w+',
shape=self.shape)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PEP8 indent.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

@charris
Copy link
Member

charris commented Feb 5, 2014

LGTM modulo comments.

mktemp only returns a filename, a malicous user could replace it before
it gets used.
charris added a commit that referenced this pull request Feb 6, 2014
@charris charris merged commit c7a30d5 into numpy:master Feb 6, 2014
@charris
Copy link
Member

charris commented Feb 6, 2014

Merged, thanks.

@Arfrever
Copy link
Contributor

Arfrever commented Feb 8, 2014

The change in numpy/lib/tests/test_io.py introduced 1 error in test suite.
Result with Python 2.7:

======================================================================
ERROR: test_big_arrays (test_io.TestSavezLoad)
----------------------------------------------------------------------
Traceback (most recent call last):
...
  File "/tmp/numpy-1.8.0/test-2.7/lib/python/numpy/lib/tests/test_io.py", line 161, in test_big_arrays
    npfile = np.load(tmp)
  File "/tmp/numpy-1.8.0/test-2.7/lib/python/numpy/lib/npyio.py", line 378, in load
    magic = fid.read(N)
IOError: File not open for reading

----------------------------------------------------------------------

Result with Python 3.3:

======================================================================
ERROR: test_big_arrays (test_io.TestSavezLoad)
----------------------------------------------------------------------
Traceback (most recent call last):
...
  File "/tmp/numpy-1.8.0/test-3.3/lib/python/numpy/lib/tests/test_io.py", line 159, in test_big_arrays
    np.savez(tmp, a=a)
  File "/tmp/numpy-1.8.0/test-3.3/lib/python/numpy/lib/npyio.py", line 530, in savez
    _savez(file, args, kwds, False)
  File "/tmp/numpy-1.8.0/test-3.3/lib/python/numpy/lib/npyio.py", line 592, in _savez
    zip.write(tmpfile, arcname=fname)
  File "/usr/lib64/python3.3/zipfile.py", line 1362, in write
    self.fp.write(zinfo.FileHeader(zip64))
TypeError: must be str, not bytes

----------------------------------------------------------------------

You need to use "w+b" mode and call tmp.seek(0) before np.load.

@juliantaylor
Copy link
Contributor Author

weird why did I open the file in my patch in the first place, fix in #4271

@juliantaylor juliantaylor deleted the mktemp-remove branch February 9, 2014 11:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants