mirror of
https://github.com/libsdl-org/SDL.git
synced 2026-02-15 08:13:13 +00:00
ef1fdf11bd
If we write directly to filenames in /tmp, we're subject to time-of-check/time-of-use symlink attacks on most systems (although recent Linux kernels mitigate these by default). We can avoid these attacks by securely creating a directory owned by our own uid, and doing all our file I/O in that directory. Other uids cannot create symbolic links in that directory, so we are protected from symlink attacks. This does not protect us from an attacker that is running with the same uid, but if such an attacker exists, then we have already lost. Resolves: https://github.com/libsdl-org/SDL/issues/11887 Signed-off-by: Simon McVittie <smcv@collabora.com>
Simple DirectMedia Layer (SDL) Version 3.0
Simple DirectMedia Layer is a cross-platform development library designed to provide low level access to audio, keyboard, mouse, joystick, and graphics hardware. It is used by video playback software, emulators, and popular games including Valve's award winning catalog and many Humble Bundle games.
More extensive documentation is available in the docs directory, starting with README.md. If you are migrating to SDL 3.0 from SDL 2.0, the changes are extensively documented in README-migration.md.
Enjoy!
Sam Lantinga (slouken@libsdl.org)