libpq: Fix minor TOCTOU violation
authorPeter Eisentraut <[email protected]>
Fri, 16 Aug 2024 04:41:17 +0000 (06:41 +0200)
committerPeter Eisentraut <[email protected]>
Fri, 16 Aug 2024 04:41:17 +0000 (06:41 +0200)
commite882bcae032d5e89777e2a1f3d78dfb77c17c192
tree48e4329a530e998bf9e4d44195bad3a9f03c0d43
parente3ec9dc1bf4983fcedb6f43c71ea12ee26aefc7a
libpq: Fix minor TOCTOU violation

libpq checks the permissions of the password file before opening it.
The way this is done in two separate operations, a static analyzer
would flag as a time-of-check-time-of-use violation.  In practice, you
can't do anything with that, but it still seems better style to fix
it.

To fix it, open the file first and then check the permissions on the
opened file handle.

Reviewed-by: Aleksander Alekseev <[email protected]>
Reviewed-by: Andreas Karlsson <[email protected]>
Discussion: https://www.postgresql.org/message-id/flat/a3356054-14ae-4e7a-acc6-249d19dac20b%40eisentraut.org
src/interfaces/libpq/fe-connect.c