mirror of
https://github.com/freebsd/freebsd-src
synced 2024-10-15 04:43:53 +00:00
Fixed an evil bug where rawname() could write across the boundaries of
an array. The bug became obvious in the old system where the array was only 32 characters long (now MAXPATHLEN). Dump honored its name then (:-) and dumped its core when calling dump -w for a fstab that contained rather long NFS file system names. Even though this is rather unlikely to happen now, a bug is a bug:)
This commit is contained in:
parent
3023486ce7
commit
56d5f6db85
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=3974
|
@ -537,10 +537,10 @@ rawname(cp)
|
|||
if (dp == NULL)
|
||||
return (NULL);
|
||||
*dp = '\0';
|
||||
(void)strcpy(rawbuf, cp);
|
||||
(void)strncpy(rawbuf, cp, MAXPATHLEN - 1);
|
||||
*dp = '/';
|
||||
(void)strcat(rawbuf, "/r");
|
||||
(void)strcat(rawbuf, dp + 1);
|
||||
(void)strncat(rawbuf, "/r", strlen(rawbuf) - (MAXPATHLEN - 1));
|
||||
(void)strncat(rawbuf, dp + 1, strlen(rawbuf) - (MAXPATHLEN - 1));
|
||||
return (rawbuf);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue