Re: mktemp()

Well, I'm also not sure about the availability of mktemp() et al on windows, so I was proposing a functionally equivalent (or superior) alternative written in pike.

On Tue, 15 Jul 2008, Dan Nelson wrote:

There's no such thing as an atomic mktemp(). Use of mktemp() is inherently race-prone, since it simply returns a filename that doesn't exist at the time of the call, and it's up to the application to call open() correctly (i.e. with O_EXCL|O_CREAT to ensure that an attacker's symlink isn't followed), and retry if the open fails. I'd suggest implementing mkstemp() or mkstemps() instead, so you do all the work and return a fd or FILE back to the user.