mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-22 17:54:52 +00:00
Prevent buffer overflow if NLSPATH is too long
This commit is contained in:
parent
f907abc0b3
commit
86797bf956
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=65609
|
@ -144,6 +144,8 @@ catopen( name, type)
|
|||
++nlspath;
|
||||
/* fallthrough */
|
||||
default:
|
||||
if (pathP - path >= sizeof(path) - 1)
|
||||
goto too_long;
|
||||
*(pathP++) = *nlspath;
|
||||
continue;
|
||||
}
|
||||
|
@ -151,13 +153,17 @@ catopen( name, type)
|
|||
put_tmpptr:
|
||||
spcleft = sizeof(path) - (pathP - path) - 1;
|
||||
if (strlcpy(pathP, tmpptr, spcleft) >= spcleft) {
|
||||
too_long:
|
||||
free(plang);
|
||||
free(base);
|
||||
NLRETERR(ENAMETOOLONG);
|
||||
}
|
||||
pathP += strlen(tmpptr);
|
||||
} else
|
||||
} else {
|
||||
if (pathP - path >= sizeof(path) - 1)
|
||||
goto too_long;
|
||||
*(pathP++) = *nlspath;
|
||||
}
|
||||
}
|
||||
*pathP = '\0';
|
||||
if (stat(path, &sbuf) == 0) {
|
||||
|
|
Loading…
Reference in a new issue