Patch CVE-2023-43783: Use of Fixed Temporary File Path in /tmp/cadence-wineasio.reg

Apply SuSE fix for CVE-2023-43783 (by Matthias Gerstner)

0001-cadence.py-wine-ASIO-settings-use-safe-tempfile.patch

https://bugzilla.suse.com/show_bug.cgi?id=1213985

src/cadence.py

@@ -38,6 +38,7 @@ import ui_cadence_tb_alsa
 import ui_cadence_tb_a2j
 import ui_cadence_tb_pa
 import ui_cadence_rwait
+from shared import getDaemonLockfile
 from shared_cadence import *
 from shared_canvasjack import *
 from shared_settings import *
@@ -46,6 +47,8 @@ from shared_settings import *
 # Import getoutput
 
 from subprocess import getoutput
+import tempfile
+import subprocess
 
 # ------------------------------------------------------------------------------------------------------------
 # Try Import DBus
@@ -1710,7 +1713,7 @@ class CadenceMainW(QMainWindow, ui_cadence.Ui_CadenceMainW):
 
     @pyqtSlot()
     def slot_AlsaBridgeStop(self):
-        checkFile = "/tmp/.cadence-aloop-daemon.x"
+        checkFile = self.getDaemonLockfile("cadence-aloop-daemon")
         if os.path.exists(checkFile):
             os.remove(checkFile)
 
@@ -2094,11 +2097,10 @@ class CadenceMainW(QMainWindow, ui_cadence.Ui_CadenceMainW):
             REGFILE += '"Number of outputs"=dword:000000%s\n' % smartHex(self.sb_wineasio_outs.value(), 2)
             REGFILE += '"Preferred buffersize"=dword:0000%s\n' % smartHex(int(self.cb_wineasio_bsizes.currentText()), 4)
 
-            writeFile = open("/tmp/cadence-wineasio.reg", "w")
-            writeFile.write(REGFILE)
-            writeFile.close()
-
-            os.system("regedit /tmp/cadence-wineasio.reg")
+            with tempfile.NamedTemporaryFile('w') as tmpfile:
+                tmpfile.write(REGFILE)
+                tmpfile.flush()
+                subprocess.run(["regedit", tmpfile.name])
 
         self.settings_changed_types = []
         self.frame_tweaks_settings.setVisible(False)

src/cadence_aloop_daemon.py

@@ -33,6 +33,7 @@ else:
 # Imports (Custom Stuff)
 
 import jacklib
+from shared import getDaemonLockfile
 
 # --------------------------------------------------
 # Auto re-activate if on good kernel
@@ -50,7 +51,7 @@ doRunNow  = True
 useZita   = False
 procIn    = QProcess()
 procOut   = QProcess()
-checkFile = "/tmp/.cadence-aloop-daemon.x"
+checkFile = getDaemonLockfile("cadence-aloop-daemon")
 
 # --------------------------------------------------
 # Global JACK variables
@@ -161,7 +162,7 @@ if __name__ == '__main__':
     client = jacklib.client_open("cadence-aloop-daemon", jacklib.JackUseExactName, None)
 
     if not client:
-        print("cadence-aloop-daemon is already running, delete \"/tmp/.cadence-aloop-daemon.x\" to close it")
+        print("cadence-aloop-daemon is already running, delete \"{}\" to close it".format(checkFile))
         quit()
 
     if jacklib.JACK2:

src/shared.py

@@ -312,3 +312,11 @@ def setIcons(self_, modes):
     if "misc" in modes:
         gGui.ui.act_quit.setIcon(getIcon("application-exit"))
         gGui.ui.act_configure.setIcon(getIcon("configure"))
+
+def getDaemonLockfile(base):
+    lockdir = os.environ.get("XDG_RUNTIME_DIR", None)
+    if not lockdir:
+        lockdir = os.path.expanduser("~")
+
+    return os.path.join(lockdir, "{}-lock".format(base))
+