Changeset 3914 for trunk/libc/src/kNIX/os2/fs-os2.c

Timestamp:

Oct 24, 2014, 4:01:38 PM (11 years ago)

Author:

bird

Message:

trunk,0.6: Fixed buffer overflow in fsResolveUnix that would trigger if the input path was too long.

File:

• trunk/libc/src/kNIX/os2/fs-os2.c (modified) (1 diff)

trunk/libc/src/kNIX/os2/fs-os2.c

@@ -978 +978 @@
             {
                 if ((uintptr_t)(pszUserPath - pachBuffer) > SIZEOF_ACHBUFFER)
-                    pszUserPath = strcpy(pachBuffer, pszUserPath);
+                {
+                    size_t cbUserPath = strlen(pszUserPath) + 1;
+                    if (cbUserPath > PATH_MAX)
+                    {
+                        rcRet = -ENAMETOOLONG;
+                        break;
+                    }
+                    pszUserPath = memcpy(pachBuffer, pszUserPath, cbUserPath);
+                }
                 *(char *)(void *)pszUserPath += 'A' - 'a';
             }