From 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 Mon Sep 17 00:00:00 2001
From: wiredfool <eric-github@soroos.net>
Date: Fri, 14 Mar 2014 15:56:41 -0700
Subject: [PATCH] Removed tempfile.mktemp, fixes CVE-2014-1932 CVE-2014-1933,
 debian bug #737059

---
 PIL/EpsImagePlugin.py  |  3 ++-
 PIL/Image.py           |  9 ++++++---
 PIL/IptcImagePlugin.py |  4 ++--
 PIL/JpegImagePlugin.py | 12 ++++++++----
 4 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/PIL/EpsImagePlugin.py b/PIL/EpsImagePlugin.py
index a8706b05f..fcfae8a81 100644
--- a/PIL/EpsImagePlugin.py
+++ b/PIL/EpsImagePlugin.py
@@ -67,7 +67,8 @@ def Ghostscript(tile, size, fp, scale=1):
 
     import tempfile, os, subprocess
 
-    file = tempfile.mktemp()
+    out_fd, file = tempfile.mkstemp()
+    os.close(out_fd)
 
     # Build ghostscript command
     command = ["gs",
diff --git a/PIL/Image.py b/PIL/Image.py
index 87631d6f7..915f5b1df 100644
--- a/PIL/Image.py
+++ b/PIL/Image.py
@@ -495,14 +495,17 @@ class Image:
         self.readonly = 0
 
     def _dump(self, file=None, format=None):
-        import tempfile
+        import tempfile, os
         if not file:
-            file = tempfile.mktemp()
+            f, file = tempfile.mkstemp(format or '')
+            os.close(f)
+            
         self.load()
         if not format or format == "PPM":
             self.im.save_ppm(file)
         else:
-            file = file + "." + format
+            if file.endswith(format):
+                file = file + "." + format
             self.save(file, format)
         return file
 
diff --git a/PIL/IptcImagePlugin.py b/PIL/IptcImagePlugin.py
index 157b73509..104153002 100644
--- a/PIL/IptcImagePlugin.py
+++ b/PIL/IptcImagePlugin.py
@@ -172,8 +172,8 @@ class IptcImageFile(ImageFile.ImageFile):
         self.fp.seek(offset)
 
         # Copy image data to temporary file
-        outfile = tempfile.mktemp()
-        o = open(outfile, "wb")
+        o_fd, outfile = tempfile.mkstemp(text=False)
+        o = os.fdopen(o_fd)
         if encoding == "raw":
             # To simplify access to the extracted file,
             # prepend a PPM header
diff --git a/PIL/JpegImagePlugin.py b/PIL/JpegImagePlugin.py
index 90d3b5194..67dc5ba7d 100644
--- a/PIL/JpegImagePlugin.py
+++ b/PIL/JpegImagePlugin.py
@@ -344,13 +344,17 @@ class JpegImageFile(ImageFile.ImageFile):
         # ALTERNATIVE: handle JPEGs via the IJG command line utilities
 
         import tempfile, os
-        file = tempfile.mktemp()
-        os.system("djpeg %s >%s" % (self.filename, file))
+        f, path = tempfile.mkstemp()
+        os.close(f)
+        if os.path.exists(self.filename):
+            os.system("djpeg '%s' >'%s'" % (self.filename, path))
+        else:
+            raise ValueError("Invalid Filename")
 
         try:
-            self.im = Image.core.open_ppm(file)
+            self.im = Image.core.open_ppm(path)
         finally:
-            try: os.unlink(file)
+            try: os.unlink(path)
             except: pass
 
         self.mode = self.im.mode