strange warning in build process

[sl1pkn07]

Building JPEG XR shared lib
mkdir -p /tmp/makepkg/jxrlib-git/src/jxrlib/build
cc -shared /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/encode/encode.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/encode/segenc.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/encode/strenc.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/encode/strFwdTransform.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/encode/strPredQuantEnc.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/decode/decode.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/decode/postprocess.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/decode/segdec.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/decode/strdec.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/decode/strInvTransform.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/decode/strPredQuantDec.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/decode/JXRTranscode.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/sys/adapthuff.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/sys/image.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/sys/strcodec.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/sys/strPredQuant.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/sys/strTransform.o /tmp/makepkg/jxrlib-git/src/jxrlib/build/image/sys/perfTimerANSI.o -o /tmp/makepkg/jxrlib-git/src/jxrlib/build/libjpegxr.so
/tmp/makepkg/jxrlib-git/src/jxrlib/build/image/encode/strenc.o: In function `StrIOEncInit':
strenc.c:(.text+0xc17): warning: the use of `tmpnam' is dangerous, better use `mkstemp'

gcc is 6.2.1

greetings

[sl1pkn07]

same with gcc 7.1.1

[mloskot]

@sl1pkn07 What strange is in this warning?

https://www.gnu.org/software/libc/manual/html_node/Temporary-Files.html

Warning: Between the time the pathname is constructed and the file is created
another process might have created a file with the same name using tmpnam,
leading to a possible security hole.
The implementation generates names which can hardly be predicted, but when
opening the file you should use the O_EXCL flag.
Using tmpfile or mkstemp is a safe way to avoid this problem.

[sl1pkn07]

the strange is, why is appeared? is not possible silence by fix?

jxrlib/image/encode/strenc.c

Line 485 in 98e615d

if ((pFilename = tmpnam(NULL)) == NULL)

edit: same with gcc 9.2.0

[mloskot]

the strange is, why is appeared?

Well, since that code uses the tmpnam function which is mentioned in the libc documentation as having potential security hole, the compiler issues the warning. There is literally nothing strange in that. I'd risk statement it is an expected behaviour.

is not possible silence by fix?

I'm sure it is possible. It's just that someone needs to do the work, fix it and propose patch. I'm sure this repo will be happy to accept a pull request...