---
id: "bug-1861"
status: "fixed"
status_updated: "2026-09-25"
status_note: "b5d59253"
component: "controller"
severity: "unknown"
timestamp: "2026-09-24T15:05:56Z"
last_seen: "2026-09-24T15:05:56Z"
occurrences: 1
files: ["src/controller/config_repl.c"]
tags: ["controller", "security", "tmpfile", "config-upgrade"]
related: []
fix_commits: ["b5d59253"]
legacy: true
gitea_issue: 280
gitea_synced_status: "fixed"
gitea_synced_hash: "06b29e927501"
---

# bug-1861: config_repl.c do_upgrade_config_with_bytes: temp decode file…

## Description
config_repl.c do_upgrade_config_with_bytes: temp decode file /tmp/xce_upgrade_cfg.<pthread_self()>.tmp -- the name is identical across processes (parallel controller_unit_test instances failed handle_upgrade_config with -EINVAL, 'a majority-acked upgrade must succeed') and is opened O_CREAT|O_TRUNC without O_EXCL in world-writable /tmp

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
pthread_self() is a thread-descriptor address, not a unique id: the main thread's value repeats across processes (esp. with ASLR off under ASAN), so two processes on one host share and clobber the file; a predictable name opened without O_EXCL in /tmp is also a symlink-attack target (write/truncate through an attacker's link).

## Fix
_Not recorded (migrated from buglog.json)._

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Gitea: #280