[PATCH] erofs-utils: lib: create Windows temporary files atomically

[Gao Xiang <xiang.gao@docker.com>]

GetTempFileNameA() creates and closes a file before it is reopened
with FILE_FLAG_DELETE_ON_CLOSE. Exiting between these calls leaves
the temporary file behind.

Use CREATE_NEW with FILE_FLAG_DELETE_ON_CLOSE to create temporary
files with cleanup enabled from the start. Generate random names
and retry collisions without opening existing files.

Also honor TMPDIR and preserve errors on descriptor allocation failure.
Since erofs_os_tmpfile() returns negative errors directly, propagate
its return value in the OCI caller rather than relying on errno.

Fixes: f9ceb52fa646 ("erofs-utils: add native Windows support")
Signed-off-by: Gao Xiang <xiang.gao@docker.com>
---
 lib/remotes/oci.c    |  8 ++++--
 lib/windows_compat.c | 67 +++++++++++++++++++++++++++-----------------
 2 files changed, 47 insertions(+), 28 deletions(-)

diff --git a/lib/remotes/oci.c b/lib/remotes/oci.c
index 3243ccc..948d699 100644
--- a/lib/remotes/oci.c
+++ b/lib/remotes/oci.c
@@ -1260,12 +1260,14 @@ static int ocierofs_extract_layer(struct ocierofs_ctx *ctx,
 
 	stream = (struct ocierofs_stream) {
 		.digest = digest,
-		.blobfd = erofs_os_tmpfile(),
 	};
-	if (stream.blobfd < 0) {
+
+	ret = erofs_os_tmpfile();
+	if (ret < 0) {
 		erofs_err("failed to create temporary file for %s", digest);
-		return -errno;
+		return ret;
 	}
+	stream.blobfd = ret;
 
 	ret = ocierofs_download_blob_to_fd(ctx, digest, auth_header, stream.blobfd);
 	if (ret)
diff --git a/lib/windows_compat.c b/lib/windows_compat.c
index 1582fd3..d5e3fb3 100644
--- a/lib/windows_compat.c
+++ b/lib/windows_compat.c
@@ -277,38 +277,55 @@ int erofs_win_random(void *buf, unsigned int len)
 int erofs_os_tmpfile(void)
 {
 	char path[MAX_PATH], name[MAX_PATH];
-	HANDLE h;
-	DWORD len;
+	const char *tmpdir, *sep = "";
+	HANDLE h = INVALID_HANDLE_VALUE;
+	unsigned int retries;
 	int fd;
 
-	len = GetTempPathA(sizeof(path), path);
-	if (!len) {
-		errno = erofs_err_win_to_posix(GetLastError());
-		return -errno;
+	tmpdir = getenv("TMPDIR");
+	if (tmpdir && *tmpdir) {
+		/* A trailing backslash may be part of a multibyte character. */
+		sep = "/";
+	} else {
+		DWORD len = GetTempPathA(sizeof(path), path);
+
+		if (!len)
+			return -erofs_err_win_to_posix(GetLastError());
+		if (len >= sizeof(path))
+			return -ENAMETOOLONG;
+		tmpdir = path;
 	}
-	if (len >= sizeof(path)) {
-		errno = ENAMETOOLONG;
-		return -errno;
-	}
-	if (!GetTempFileNameA(path, "ero", 0, name)) {
-		errno = erofs_err_win_to_posix(GetLastError());
-		return -errno;
-	}
-	h = CreateFileA(name, GENERIC_READ | GENERIC_WRITE,
-		FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL,
-		OPEN_EXISTING, FILE_ATTRIBUTE_TEMPORARY |
-		FILE_FLAG_DELETE_ON_CLOSE, NULL);
-	if (h == INVALID_HANDLE_VALUE) {
-		DWORD error = GetLastError();
-
-		DeleteFileA(name);
-		errno = erofs_err_win_to_posix(error);
-		return -errno;
+	/* Arm cleanup when creating the file, with no close-and-reopen gap. */
+	for (retries = 128; retries; --retries) {
+		unsigned int nonce[2];
+		DWORD error;
+		int n;
+
+		if (erofs_win_random(nonce, sizeof(nonce)) < 0)
+			return -errno;
+		n = snprintf(name, sizeof(name), "%s%sEROFS_%08x%08x.TMP",
+			     tmpdir, sep, nonce[0], nonce[1]);
+		if (n < 0 || (size_t)n >= sizeof(name))
+			return -ENAMETOOLONG;
+		h = CreateFileA(name, GENERIC_READ | GENERIC_WRITE,
+			FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+			NULL, CREATE_NEW, FILE_ATTRIBUTE_TEMPORARY |
+			FILE_FLAG_DELETE_ON_CLOSE, NULL);
+		if (h != INVALID_HANDLE_VALUE)
+			break;
+		error = GetLastError();
+		if (error == ERROR_FILE_EXISTS || error == ERROR_ALREADY_EXISTS)
+			continue;
+		return -erofs_err_win_to_posix(error);
 	}
+	if (h == INVALID_HANDLE_VALUE)
+		return -EEXIST;
 	fd = _open_osfhandle((intptr_t)h, O_RDWR | O_BINARY);
 	if (fd < 0) {
+		int err = -errno;
+
 		CloseHandle(h);
-		return -errno;
+		return err;
 	}
 	return fd;
 }
-- 
2.54.0 (Apple Git-157)