===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/rcs/rcs.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -c -r1.6 -r1.7
*** src/usr.bin/rcs/rcs.c	2006/05/01 18:17:39	1.6
--- src/usr.bin/rcs/rcs.c	2006/05/04 07:06:58	1.7
***************
*** 1,4 ****
! /*	$OpenBSD: rcs.c,v 1.6 2006/05/01 18:17:39 niallo Exp $	*/
  /*
   * Copyright (c) 2004 Jean-Francois Brousseau <jfb@openbsd.org>
   * All rights reserved.
--- 1,4 ----
! /*	$OpenBSD: rcs.c,v 1.7 2006/05/04 07:06:58 xsa Exp $	*/
  /*
   * Copyright (c) 2004 Jean-Francois Brousseau <jfb@openbsd.org>
   * All rights reserved.
***************
*** 358,364 ****
  rcs_write(RCSFILE *rfp)
  {
  	FILE *fp;
! 	char buf[1024], numbuf[64], fn[20] = "";
  	void *bp;
  	struct rcs_access *ap;
  	struct rcs_sym *symp;
--- 358,364 ----
  rcs_write(RCSFILE *rfp)
  {
  	FILE *fp;
! 	char buf[1024], numbuf[64], *fn;
  	void *bp;
  	struct rcs_access *ap;
  	struct rcs_sym *symp;
***************
*** 367,375 ****
  	struct rcs_lock *lkp;
  	ssize_t nread, nwritten;
  	size_t len;
! 	int fd, from_fd, to_fd;
  
  	from_fd = to_fd = fd = -1;
  
  	if (rfp->rf_flags & RCS_SYNCED)
  		return (0);
--- 367,376 ----
  	struct rcs_lock *lkp;
  	ssize_t nread, nwritten;
  	size_t len;
! 	int fd, from_fd, to_fd, ret;
  
  	from_fd = to_fd = fd = -1;
+ 	ret = -1;
  
  	if (rfp->rf_flags & RCS_SYNCED)
  		return (0);
***************
*** 377,384 ****
  	/* Write operations need the whole file parsed */
  	rcs_parse_deltatexts(rfp, NULL);
  
! 	if (strlcpy(fn, "/tmp/rcs.XXXXXXXXXX", sizeof(fn)) >= sizeof(fn))
! 		errx(1, "rcs_write: string truncated");
  	if ((fd = mkstemp(fn)) == -1)
  		err(1, "%s", fn);
  
--- 378,385 ----
  	/* Write operations need the whole file parsed */
  	rcs_parse_deltatexts(rfp, NULL);
  
! 	(void)xasprintf(&fn, "%s/rcs.XXXXXXXXXX", rcs_tmpdir);
! 
  	if ((fd = mkstemp(fn)) == -1)
  		err(1, "%s", fn);
  
***************
*** 514,529 ****
  			}
  
  			if ((from_fd = open(fn, O_RDONLY)) == -1) {
! 				warn("failed to open `%s'",
! 				    rfp->rf_path);
! 				return (-1);
  			}
  
  			if ((to_fd = open(rfp->rf_path,
  			    O_WRONLY|O_TRUNC|O_CREAT)) == -1) {
  				warn("failed to open `%s'", fn);
! 				close(from_fd);
! 				return (-1);
  			}
  
  			bp = xmalloc(MAXBSIZE);
--- 515,528 ----
  			}
  
  			if ((from_fd = open(fn, O_RDONLY)) == -1) {
! 				warn("failed to open `%s'", rfp->rf_path);
! 				goto out;
  			}
  
  			if ((to_fd = open(rfp->rf_path,
  			    O_WRONLY|O_TRUNC|O_CREAT)) == -1) {
  				warn("failed to open `%s'", fn);
! 				goto out;
  			}
  
  			bp = xmalloc(MAXBSIZE);
***************
*** 541,574 ****
  err:				if (unlink(rfp->rf_path) == -1)
  					warn("failed to unlink `%s'",
  					    rfp->rf_path);
- 				close(from_fd);
- 				close(to_fd);
  				xfree(bp);
! 				return (-1);
  			}
- 
- 			close(from_fd);
- 			close(to_fd);
  			xfree(bp);
  
  			if (unlink(fn) == -1) {
  				warn("failed to unlink `%s'", fn);
! 				return (-1);
  			}
  		} else {
  			warn("failed to access temp RCS output file");
! 			return (-1);
  		}
  	}
  
  	if (chmod(rfp->rf_path, rfp->rf_mode) == -1) {
  		warn("failed to chmod `%s'", rfp->rf_path);
! 		return (-1);
  	}
  
  	rfp->rf_flags |= RCS_SYNCED;
  
! 	return (0);
  }
  
  /*
--- 540,576 ----
  err:				if (unlink(rfp->rf_path) == -1)
  					warn("failed to unlink `%s'",
  					    rfp->rf_path);
  				xfree(bp);
! 				goto out;
  			}
  			xfree(bp);
  
  			if (unlink(fn) == -1) {
  				warn("failed to unlink `%s'", fn);
! 				goto out;
  			}
  		} else {
  			warn("failed to access temp RCS output file");
! 			goto out;
  		}
  	}
  
  	if (chmod(rfp->rf_path, rfp->rf_mode) == -1) {
  		warn("failed to chmod `%s'", rfp->rf_path);
! 		goto out;
  	}
  
  	rfp->rf_flags |= RCS_SYNCED;
  
! 	ret = 0;
! out:
! 	(void)close(from_fd);
! 	(void)close(to_fd);
! 
! 	if (fn != NULL)
! 		xfree(fn);
! 
! 	return (ret);
  }
  
  /*
***************
*** 1341,1354 ****
  int
  rcs_rev_remove(RCSFILE *rf, RCSNUM *rev)
  {
! 	size_t len;
! 	char *tmpdir;
! 	char *newdeltatext, path_tmp1[MAXPATHLEN], path_tmp2[MAXPATHLEN];
  	struct rcs_delta *rdp, *prevrdp, *nextrdp;
  	BUF *nextbuf, *prevbuf, *newdiff;
  
- 	tmpdir = rcs_tmpdir;
- 
  	if (rev == RCS_HEAD_REV)
  		rev = rf->rf_head;
  
--- 1343,1352 ----
  int
  rcs_rev_remove(RCSFILE *rf, RCSNUM *rev)
  {
! 	char *newdeltatext, *path_tmp1, *path_tmp2;
  	struct rcs_delta *rdp, *prevrdp, *nextrdp;
  	BUF *nextbuf, *prevbuf, *newdiff;
  
  	if (rev == RCS_HEAD_REV)
  		rev = rf->rf_head;
  
***************
*** 1383,1409 ****
  		newdiff = rcs_buf_alloc(64, BUF_AUTOEXT);
  
  		/* calculate new diff */
! 		len = strlcpy(path_tmp1, tmpdir, sizeof(path_tmp1));
! 		if (len >= sizeof(path_tmp1))
! 			errx(1, "path truncation in rcs_rev_remove");
! 
! 		len = strlcat(path_tmp1, "/diff1.XXXXXXXXXX",
! 		    sizeof(path_tmp1));
! 		if (len >= sizeof(path_tmp1))
! 			errx(1, "path truncation in rcs_rev_remove");
! 
  		rcs_buf_write_stmp(nextbuf, path_tmp1, 0600);
  		rcs_buf_free(nextbuf);
  
! 		len = strlcpy(path_tmp2, tmpdir, sizeof(path_tmp2));
! 		if (len >= sizeof(path_tmp2))
! 			errx(1, "path truncation in rcs_rev_remove");
! 
! 		len = strlcat(path_tmp2, "/diff2.XXXXXXXXXX",
! 		    sizeof(path_tmp2));
! 		if (len >= sizeof(path_tmp2))
! 			errx(1, "path truncation in rcs_rev_remove");
! 
  		rcs_buf_write_stmp(prevbuf, path_tmp2, 0600);
  		rcs_buf_free(prevbuf);
  
--- 1381,1391 ----
  		newdiff = rcs_buf_alloc(64, BUF_AUTOEXT);
  
  		/* calculate new diff */
! 		(void)xasprintf(&path_tmp1, "%s/diff1.XXXXXXXXXX", rcs_tmpdir);
  		rcs_buf_write_stmp(nextbuf, path_tmp1, 0600);
  		rcs_buf_free(nextbuf);
  
! 		(void)xasprintf(&path_tmp2, "%s/diff2.XXXXXXXXXX", rcs_tmpdir);
  		rcs_buf_write_stmp(prevbuf, path_tmp2, 0600);
  		rcs_buf_free(prevbuf);
  
***************
*** 1443,1448 ****
--- 1425,1435 ----
  
  	if (newdeltatext != NULL)
  		xfree(newdeltatext);
+ 
+ 	if (path_tmp1 != NULL)
+ 		xfree(path_tmp1);
+ 	if (path_tmp2 != NULL)
+ 		xfree(path_tmp2);
  
  	return (0);
  }