Subject: | CRITICAL data loss possible in crypt_file command |
Date: | Wed, 19 Feb 2014 01:08:17 +0000 |
To: | "bug-Filter-Crypto [...] rt.cpan.org" <bug-Filter-Crypto [...] rt.cpan.org> |
From: | Randall Diffenderfer <rdiffenderfer [...] proofpoint.com> |
source — current release, perl 5.8.8, linux 2.6.18 x86_64
it is possible to clobber your source files in two scenarios, both involving "--edit-mode tempfile"
given:
unencrypted-source-file.pm
crypt_file –c decrypted –e tempfile unencrypted-source-file.pm
the rename() (that should not be done, as file was unencrypted to begin with) in line 328 of crypt_file clobbers the input file with the empty tempfile — you lose your input file!
given:
encrypted-source-file.pm
crypt_file –c encrypted –e tempfile encrypted-source-file.pm
the rename() (that should not be done, as file was encrypted to begin with) in line 328 of crypt_file clobbers the input file with the empty tempfile — you lose your input file!