Date: Fri, 19 Mar 2010 12:04:56 +0000 (UTC) From: Jaakko Heinonen <jh@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org Subject: svn commit: r205330 - stable/7/lib/libc/stdio Message-ID: <201003191204.o2JC4uIx041966@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jh Date: Fri Mar 19 12:04:56 2010 New Revision: 205330 URL: http://svn.freebsd.org/changeset/base/205330 Log: MFC r204447: In _gettemp(), check that the length of the path doesn't exceed MAXPATHLEN. Otherwise the path name (or part of it) may not fit to carrybuf causing a buffer overflow. PR: bin/140228 Modified: stable/7/lib/libc/stdio/mktemp.c Directory Properties: stable/7/lib/libc/ (props changed) stable/7/lib/libc/stdtime/ (props changed) Modified: stable/7/lib/libc/stdio/mktemp.c ============================================================================== --- stable/7/lib/libc/stdio/mktemp.c Fri Mar 19 11:59:02 2010 (r205329) +++ stable/7/lib/libc/stdio/mktemp.c Fri Mar 19 12:04:56 2010 (r205330) @@ -116,6 +116,10 @@ _gettemp(path, doopen, domkdir, slen) for (trv = path; *trv != '\0'; ++trv) ; + if (trv - path >= MAXPATHLEN) { + errno = ENAMETOOLONG; + return (0); + } trv -= slen; suffp = trv; --trv;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201003191204.o2JC4uIx041966>