Random number chosen by openTempFile is always 1804289383846930886
import System.Directory
import System.IO
main = do
(p, _) <- openTempFile "/tmp" ""
print p
removeFile p
$ runghc temp.hs
"/tmp/1804289383846930886"
$ runghc temp.hs
"/tmp/1804289383846930886"
$ runghc temp.hs
"/tmp/1804289383846930886"
$ runghc temp.hs
"/tmp/1804289383846930886"
This “random” number is the concatenation of the first two numbers 1804289383, 846930886 returned by glibc’s rand()
when not seeded (or seeded with 1).
This is not immediately a library security bug, I think: the file is created with O_EXCL
, and if it already exists, openTempFile
will move onto the next value 16816927771714636915, and so on. However, the predictable filenames make a potential application security bug that much more likely.
(For your amusement, Google 1804289383846930886.)
Trac metadata
Trac field | Value |
---|---|
Version | 7.10.2 |
Type | Bug |
TypeOfFailure | OtherFailure |
Priority | normal |
Resolution | Unresolved |
Component | libraries/base |
Test case | |
Differential revisions | |
BlockedBy | |
Related | |
Blocking | |
CC | |
Operating system | |
Architecture |