5c1049e66b
possible off by one bounds check Submitted by: Munehiro Matsuda Approved by: portmgr (marcus)
20 lines
558 B
Text
20 lines
558 B
Text
--- src/header.c 2002-07-19 17:23:58.000000000 +0900
|
|
+++ src/header.c 2004-06-16 09:49:23.000000000 +0900
|
|
@@ -648,8 +648,17 @@
|
|
}
|
|
|
|
if (dir_length) {
|
|
+ if ((dir_length + name_length) >= sizeof(dirname)) {
|
|
+ fprintf(stderr, "Insufficient buffer size\n");
|
|
+ exit(112);
|
|
+ }
|
|
strcat(dirname, hdr->name);
|
|
- strcpy(hdr->name, dirname);
|
|
+
|
|
+ if ((dir_length + name_length) >= sizeof(hdr->name)) {
|
|
+ fprintf(stderr, "Insufficient buffer size\n");
|
|
+ exit(112);
|
|
+ }
|
|
+ strncpy(hdr->name, dirname, sizeof(hdr->name));
|
|
name_length += dir_length;
|
|
}
|