nixpkgs/pkgs/tools/compression/gzip/CVE-2026-41991.patch

From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Thu, 16 Apr 2026 12:11:44 -0700
Subject: gzexe: use -C if lacking mktemp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(Problem reported by Michał Majchrowicz.)
* gzexe.in: If mktemp is needed but not installed,
use ‘set -C’ to avoid a race when creating a temporary file.
* zdiff.in: Use the same pattern here, even though the old
code was probably OK anyway.
---
 gzexe.in | 1 +
 zdiff.in | 7 +++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/gzexe.in b/gzexe.in
index ea4ef94..f3d46cc 100644
--- a/gzexe.in
+++ b/gzexe.in
@@ -127,6 +127,7 @@ for i do
     tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
   else
     tmp=${dir}gzexe$$
+    (umask 77; set -C; > "$tmp")
   fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
     res=$?
     printf >&2 '%s\n' "$0: cannot copy $file"
diff --git a/zdiff.in b/zdiff.in
index 289e466..53266df 100644
--- a/zdiff.in
+++ b/zdiff.in
@@ -156,12 +156,11 @@ case $file2 in
                           *) TMPDIR=/tmp/;;
                         esac
                         if command -v mktemp >/dev/null 2>&1; then
-                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
-                            exit 2
+                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
                         else
-                          set -C
                           tmp=${TMPDIR}zdiff$$
-                        fi
+                          (umask 77; set -C; > "$tmp")
+                        fi &&
                         'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
                         gzip_status=$(
                           exec 4>&1
-- 
cgit v1.2.3