Create files with with 000 permissions to avoid leaking yet unchecked data

As we are calculating the check sum while writing we only know the file
content is correct after it being written comletely. CVE-2013-6435

(cherry picked from commit 7e26e2bd726f48836be289400c7d82cb8b067dc1)

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/fsm.c b/lib/fsm.c
index 7ae4747a2..5b6449c72 100644
--- a/lib/fsm.c
+++ b/lib/fsm.c
@@ -215,7 +215,12 @@ static int expandRegular(rpmfi fi, const char *dest, rpmpsm psm, int nodigest, i
     FD_t wfd = NULL;
     int rc = 0;
 
-    wfd = Fopen(dest, "w.ufdio");
+    /* Create the file with 000 permissions. */
+    {
+	mode_t old_umask = umask(0777);
+	wfd = Fopen(dest, "w.ufdio");
+	umask(old_umask);
+    }
     if (Ferror(wfd)) {
 	rc = RPMERR_OPEN_FAILED;
 	goto exit;