svn commit: r205331 - stable/6/lib/libc/stdio
Jaakko Heinonen
jh at FreeBSD.org
Fri Mar 19 12:07:29 UTC 2010
Author: jh
Date: Fri Mar 19 12:07:28 2010
New Revision: 205331
URL: http://svn.freebsd.org/changeset/base/205331
Log:
MFC r204447:
In _gettemp(), check that the length of the path doesn't exceed
MAXPATHLEN. Otherwise the path name (or part of it) may not fit to
carrybuf causing a buffer overflow.
PR: bin/140228
Modified:
stable/6/lib/libc/stdio/mktemp.c
Directory Properties:
stable/6/lib/libc/ (props changed)
Modified: stable/6/lib/libc/stdio/mktemp.c
==============================================================================
--- stable/6/lib/libc/stdio/mktemp.c Fri Mar 19 12:04:56 2010 (r205330)
+++ stable/6/lib/libc/stdio/mktemp.c Fri Mar 19 12:07:28 2010 (r205331)
@@ -120,6 +120,10 @@ _gettemp(path, doopen, domkdir, slen)
for (trv = path; *trv != '\0'; ++trv)
;
+ if (trv - path >= MAXPATHLEN) {
+ errno = ENAMETOOLONG;
+ return (0);
+ }
trv -= slen;
suffp = trv;
--trv;
More information about the svn-src-all
mailing list