Re: [Bug-wget] Wget - acess list bypass / race condition PoC

[Eli Zaretskii]

> From: Giuseppe Scrivano <address@hidden>
> Date: Sun, 21 Aug 2016 15:26:58 +0200
> Cc: "address@hidden" <address@hidden>,
>       Dawid Golunski <address@hidden>,
>       "address@hidden" <address@hidden>
> 
>  #else /* def __VMS */
> -          *fp = fopen (hs->local_file, "wb");
> +          if (opt.delete_after
> +            || opt.spider /* opt.recursive is implicitely true */
> +            || !acceptable (hs->local_file))
> +            {
> +              *fp = fdopen (open (hs->local_file, O_CREAT | O_TRUNC | 
> O_WRONLY, S_IRUSR | S_IWUSR), "wb");
> +            }

For this to work on MS-Windows, the 'open' call should use O_BINARY,
in addition to the other flags.  Otherwise, the "b" in "wb" of
'fdopen' will be ignored by the MS runtime.

Thanks.