TOCTTOU in File::Path::rmtree() Version 2.12 (continued 1)

• lstat is a system call made to store information for later use

  • Hence, qualifies as a "Time of Check"

        if ( -d _ ) {

• lstat and stat set the special _ filehandle

  • Use as operand to file test operator to avoid expense of another system call

  • Boils down to: "If we have a directory, ..."

continued...