http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=488456
Patch by Kees Cook <kees@outflux.net>
--- a/libedit/vi.c 2006-10-22 17:48:13.000000000 +1000
+++ b/libedit/vi.c 2009-06-23 08:35:58.000000000 +1000
@@ -1012,8 +1012,12 @@ vi_histedit(EditLine *el, int c)
if (fd < 0)
return CC_ERROR;
cp = el->el_line.buffer;
- write(fd, cp, el->el_line.lastchar - cp +0u);
- write(fd, "\n", 1);
+ if (write(fd, cp, el->el_line.lastchar - cp +0u)<0 ||
+ write(fd, "\n", 1)<0) {
+ close(fd);
+ unlink(tempfile);
+ return CC_ERROR;
+ }
pid = fork();
switch (pid) {
case -1: