Author: jh
Date: Fri Mar 19 12:07:28 2010
New Revision: 205331
URL: http://svn.freebsd.org/changeset/base/205331
Log:
MFC r204447:
In _gettemp(), check that the length of the path doesn't exceed
MAXPATHLEN. Otherwise the path name (or part of it) may not fit to
carrybuf causing a buffer overflow.
PR: bin/140228
Modified:
stable/6/lib/libc/stdio/mktemp.c
Directory Properties:
stable/6/lib/libc/ (props changed)
Modified: stable/6/lib/libc/stdio/mktemp.c
==============================================================================
--- stable/6/lib/libc/stdio/mktemp.c Fri Mar 19 12:04:56 2010
(r205330)
+++ stable/6/lib/libc/stdio/mktemp.c Fri Mar 19 12:07:28 2010
(r205331)
@@ -120,6 +120,10 @@ _gettemp(path, doopen, domkdir, slen)
for (trv = path; *trv != '\0'; ++trv)
;
+ if (trv - path >= MAXPATHLEN) {
+ errno = ENAMETOOLONG;
+ return (0);
+ }
trv -= slen;
suffp = trv;
--trv;
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
