Bug#26233 very suspect code in mf_tempfile.c, in function create_temp_file()

 - Rework the windows implementation in 'create_temp_file' to be
   thread safe by using GetTempFileName instad of fiddling
   with "environ"


mysys/mf_tempfile.c:
  - Update windows implementation  of 'create_temp_file' to use
    GetTempFileName in favor of fiddeling with "environ" in an unsafe way
  - Remove the implementation that is supposed to be used if not
    windows, not mkstemp or tmpnam exists as it not longer compiles it
    can't be used anywhere.
  - Update function comment for 'create_temp_file'
mysys/my_static.c:
  Remove unused variable
mysys/my_static.h:
  Remove unused variable

mysys/mf_tempfile.c

@@ -22,15 +22,36 @@
 #include <paths.h>
 #endif
 
-#ifdef HAVE_TEMPNAM
-#if !defined(MSDOS) && !defined(OS2) && !defined(__NETWARE__)
-extern char **environ;
-#endif
-#endif
+
 
 /*
-  Create a temporary file in a given directory
-  This function should be used instead of my_tempnam() !
+  @brief
+  Create a temporary file with unique name in a given directory
+
+  @details
+  create_temp_file
+    to             pointer to buffer where temporary filename will be stored
+    dir            directory where to create the file
+    prefix         prefix the filename with this
+    mode           Flags to use for my_create/my_open
+    MyFlags        Magic flags
+
+  @return
+    File descriptor of opened file if success
+    -1 and sets errno if fails.
+
+  @note
+    The behaviour of this function differs a lot between
+    implementation, it's main use is to generate a file with
+    a name that does not already exist.
+
+    When passing O_TEMPORARY flag in "mode" the file should
+    be automatically deleted
+
+    The implementation using mkstemp should be considered the
+    reference implementation when adding a new or modifying an
+    existing one
+
 */
 
 File create_temp_file(char *to, const char *dir, const char *prefix,
@@ -38,41 +59,33 @@ File create_temp_file(char *to, const char *dir, const char *prefix,
 		      myf MyFlags __attribute__((unused)))
 {
   File file= -1;
+
   DBUG_ENTER("create_temp_file");
-#if defined(_MSC_VER)
+  DBUG_PRINT("enter", ("dir: %s, prefix: %s", dir, prefix));
+#if defined (__WIN__)
+
+   /*
+     Use GetTempFileName to generate a unique filename, create
+     the file and release it's handle
+      - uses up to the first three letters from prefix
+   */
+  if (GetTempFileName(dir, prefix, 0, to) == 0)
+    DBUG_RETURN(-1);
+
+  DBUG_PRINT("info", ("name: %s", to));
+
+  /*
+    Open the file without the "open only if file doesn't already exist"
+    since the file has already been created by GetTempFileName
+  */
+  if ((file= my_open(to,  (mode & ~O_EXCL), MyFlags)) < 0)
   {
-    char temp[FN_REFLEN],*end,*res,**old_env,*temp_env[1];
-    old_env=environ;
-    if (dir)
-    {
-      end=strend(dir)-1;
-      if (!dir[0])
-      {				/* Change empty string to current dir */
-	to[0]= FN_CURLIB;
-	to[1]= 0;
-	dir=to;
-      }
-      else if (*end == FN_DEVCHAR)
-      {				/* Get current dir for drive */
-	_fullpath(temp,dir,FN_REFLEN);
-	dir=to;
-      }
-      else if (*end == FN_LIBCHAR && dir < end && end[-1] != FN_DEVCHAR)
-      {
-	strmake(to,dir,(uint) (end-dir));	/* Copy and remove last '\' */
-	dir=to;
-      }
-      environ=temp_env;		/* Force use of dir (dir not checked) */
-      temp_env[0]=0;
-    }
-    if ((res=tempnam((char*) dir,(char *) prefix)))
-    {
-      strmake(to,res,FN_REFLEN-1);
-      (*free)(res);
-      file=my_create(to,0, mode | O_EXCL | O_NOFOLLOW, MyFlags);
-    }
-    environ=old_env;
+    /* Open failed, remove the file created by GetTempFileName */
+    int tmp= my_errno;
+    (void) my_delete(to, MYF(0));
+    my_errno= tmp;
   }
+
 #elif defined(_ZTC__)
   if (!dir)
     dir=getenv("TMPDIR");
@@ -101,6 +114,8 @@ File create_temp_file(char *to, const char *dir, const char *prefix,
     }
     strmov(convert_dirname(to,dir,NullS),prefix_buff);
     org_file=mkstemp(to);
+    if (mode & O_TEMPORARY)
+      (void) my_delete(to, MYF(MY_WME | ME_NOINPUT));
     file=my_register_filename(org_file, to, FILE_BY_MKSTEMP,
 			      EE_CANTCREATEFILE, MyFlags);
     /* If we didn't manage to register the name, remove the temp file */
@@ -113,6 +128,10 @@ File create_temp_file(char *to, const char *dir, const char *prefix,
   }
 #elif defined(HAVE_TEMPNAM)
   {
+#if !defined(__NETWARE__)
+    extern char **environ;
+#endif
+
     char *res,**old_env,*temp_env[1];
     if (dir && !dir[0])
     {				/* Change empty string to current dir */
@@ -120,16 +139,7 @@ File create_temp_file(char *to, const char *dir, const char *prefix,
       to[1]= 0;
       dir=to;
     }
-#ifdef OS2
-    /* changing environ variable doesn't work with VACPP */
-    char  buffer[256], *end;
-    buffer[sizeof(buffer)-1]= 0;
-    end= strxnmov(buffer, sizeof(buffer)-1, (char*) "TMP=", dir, NullS);
-    /* remove ending backslash */
-    if (end[-1] == '\\')
-      end[-1]= 0;
-    putenv(buffer);
-#elif !defined(__NETWARE__)
+#if !defined(__NETWARE__)
     old_env= (char**) environ;
     if (dir)
     {				/* Don't use TMPDIR if dir is given */
@@ -151,45 +161,12 @@ File create_temp_file(char *to, const char *dir, const char *prefix,
     {
       DBUG_PRINT("error",("Got error: %d from tempnam",errno));
     }
-#if !defined(OS2) && !defined(__NETWARE__)
+#if !defined(__NETWARE__)
     environ=(const char**) old_env;
 #endif
   }
 #else
-  {
-    register long uniq;
-    register int length;
-    my_string pos,end_pos;
-    /* Make an unique number */
-    pthread_mutex_lock(&THR_LOCK_open);
-    uniq= ((long) getpid() << 20) + (long) _my_tempnam_used++ ;
-    pthread_mutex_unlock(&THR_LOCK_open);
-    if (!dir && !(dir=getenv("TMPDIR")))	/* Use this if possibly */
-      dir=P_tmpdir;			/* Use system default */
-    length=strlen(dir)+strlen(pfx)+1;
-
-    DBUG_PRINT("test",("mallocing %d byte",length+8+sizeof(TMP_EXT)+1));
-    if (length+8+sizeof(TMP_EXT)+1 > FN_REFLENGTH)
-      errno=my_errno= ENAMETOOLONG;
-    else
-    {
-      end_pos=strmov(to,dir);
-      if (end_pos != to && end_pos[-1] != FN_LIBCHAR)
-	*end_pos++=FN_LIBCHAR;
-      end_pos=strmov(end_pos,pfx);
-
-      for (length=0 ; length < 8 && uniq ; length++)
-      {
-	*end_pos++= _dig_vec_upper[(int) (uniq & 31)];
-	uniq >>= 5;
-      }
-      (void) strmov(end_pos,TMP_EXT);
-      file=my_create(to,0,
-		     (int) (O_RDWR | O_BINARY | O_TRUNC | O_EXCL | O_NOFOLLOW |
-			    O_TEMPORARY | O_SHORT_LIVED),
-		     MYF(MY_WME));
-    }
-  }
+#error No implementation found for create_temp_file
 #endif
   if (file >= 0)
     thread_safe_increment(my_tmp_file_created,&THR_LOCK_open);

mysys/my_static.c

@@ -67,11 +67,6 @@ uint	  my_once_extra=ONCE_ALLOC_INIT;	/* Memory to alloc / block */
 #ifdef HAVE_LARGE_PAGES
 my_bool my_use_large_pages= 0;
 uint    my_large_page_size= 0;
-#endif
-
-	/* from my_tempnam */
-#if !defined(HAVE_TEMPNAM) || defined(HPUX11)
-int _my_tempnam_used=0;
 #endif
 
 	/* from safe_malloc */

mysys/my_static.h

@@ -60,10 +60,6 @@ extern const char *soundex_map;
 extern USED_MEM* my_once_root_block;
 extern uint	 my_once_extra;
 
-#if !defined(HAVE_TEMPNAM) || defined(HPUX11)
-extern int	_my_tempnam_used;
-#endif
-
 extern byte	*sf_min_adress,*sf_max_adress;
 extern uint	sf_malloc_count;
 extern struct st_irem *sf_malloc_root;