This patch fixes an issues where temporary files were created in an insecure
way.

It was first intruduced in version 3.8.3-7 and fixes
http://bugs.debian.org/438540
--- a/src/tag_file.cpp
+++ b/src/tag_file.cpp
@@ -242,8 +242,8 @@
     strcpy(sTempFile, filename.c_str());
     strcat(sTempFile, sTmpSuffix.c_str());
 
-#if ((defined(__GNUC__) && __GNUC__ >= 3  ) || !defined(HAVE_MKSTEMP))
-    // This section is for Windows folk && gcc 3.x folk
+#if !defined(HAVE_MKSTEMP)
+    // This section is for Windows folk
     fstream tmpOut;
     createFile(sTempFile, tmpOut);
 
@@ -257,7 +257,7 @@
       tmpOut.write((char *)tmpBuffer, nBytes);
     }
 
-#else //((defined(__GNUC__) && __GNUC__ >= 3  ) || !defined(HAVE_MKSTEMP))
+#else //!defined(HAVE_MKSTEMP)
 
     // else we gotta make a temp file, copy the tag into it, copy the
     // rest of the old file after the tag, delete the old file, rename
@@ -270,7 +270,7 @@
       //ID3_THROW_DESC(ID3E_NoFile, "couldn't open temp file");
     }
 
-    ofstream tmpOut(fd);
+    ofstream tmpOut(sTempFile);
     if (!tmpOut)
     {
       tmpOut.close();
@@ -285,14 +285,14 @@
     uchar tmpBuffer[BUFSIZ];
     while (file)
     {
-      file.read(tmpBuffer, BUFSIZ);
+      file.read((char *)tmpBuffer, BUFSIZ);
       size_t nBytes = file.gcount();
-      tmpOut.write(tmpBuffer, nBytes);
+      tmpOut.write((char *)tmpBuffer, nBytes);
     }
 
     close(fd); //closes the file
 
-#endif ////((defined(__GNUC__) && __GNUC__ >= 3  ) || !defined(HAVE_MKSTEMP))
+#endif ////!defined(HAVE_MKSTEMP)
 
     tmpOut.close();
     file.close();
0e3d1133ec29242e70fca1d2997a'>commit</a><a href='/guix/diff/gnu/packages/patches/ruby-anystyle-fix-dictionary-populate.patch?id=ab9f9b582e510e3d1133ec29242e70fca1d2997a'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/patches/ruby-anystyle-fix-dictionary-populate.patch'>
<input type='hidden' name='id' value='ab9f9b582e510e3d1133ec29242e70fca1d2997a'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=ab9f9b582e510e3d1133ec29242e70fca1d2997a'>root</a>/<a href='/guix/log/gnu?id=ab9f9b582e510e3d1133ec29242e70fca1d2997a'>gnu</a>/<a href='/guix/log/gnu/packages?id=ab9f9b582e510e3d1133ec29242e70fca1d2997a'>packages</a>/<a href='/guix/log/gnu/packages/patches?id=ab9f9b582e510e3d1133ec29242e70fca1d2997a'>patches</a>/<a href='/guix/log/gnu/packages/patches/ruby-anystyle-fix-dictionary-populate.patch?id=ab9f9b582e510e3d1133ec29242e70fca1d2997a'>ruby-anystyle-fix-dictionary-populate.patch</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/patches/ruby-anystyle-fix-dictionary-populate.patch?id=ab9f9b582e510e3d1133ec29242e70fca1d2997a&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2022-08-04 12:05:52 +0200'>2022-08-04</span></td><td><a href='/guix/commit/gnu/packages/patches/ruby-anystyle-fix-dictionary-populate.patch?id=14a50b62d4e8765b794861226d79f6872d6c434c'>gnu: ruby-anystyle: Initialize dictionary files.</a><span class='msg-avail'>...<span class='msg-tooltip'>For the GDBM and Marshal dictionary adapters to be useful with their
default settings, we must initialize their data files during the package
build: upstream would initialize them lazily, but that doesn't work with
an immutable installation directory (at least, not without more complex
patches). Otherwise, we would always end up rebuilding the dictionary at
startup, which is “slow” and “not recommended”.

* gnu/packages/patches/ruby-anystyle-fix-dictionary-populate.patch: New
patch.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/ruby.scm (ruby-anystyle)[patches]: Use it.
[arguments]&lt;#:phases&gt;: Add 'populate-dictionaries' phase.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Philip McGrath</td></tr>