2011.01.11 15:41 "Re: [Tiff] Missing mkstemp() on Visual Studio 2008", by Edward Lam
On 1/10/2011 7:01 PM, Igor Skochinsky wrote:
On Windows, one can use tmpfile_s().
Do NOT use tmpfile() ('secure' or not). Due to the DOS legacy, it tries to create the file in the root directory of the current drive, which fails for C:\ under non-admin user on Vista and later. Use instead tmpnam() followed by fopen() with mode "w+bTD" (write, binary, temporary, delete on close).
Good point. However, doesn't using tmpnam() will re-introduce the
possibility of a TOCTOU attack? It took me a while to find the current
CERT recommendation on this . The sad state of affairs as I read it
seems that there is no 100% secure way to create temporary files on