From 899a70bd62c36ac1103d96367c637d0ff4faf2f1 Mon Sep 17 00:00:00 2001 From: Nirbhay Choubey Date: Fri, 4 Jan 2013 16:38:12 +0530 Subject: Bug#16066243 PB2 FAILURES I_MAIN.BUG15912213 AND I_MAIN.CTYPE_UTF8 FOR MACOSX10.6 FOR 5.1 While converting directory name to filename, a file separator (FN_LIBCHAR) might get appended to the resulting file name. This can result in off-by-one error when length of the input string is equal to FN_REFLEN. In this case, the terminating '\0' gets written beyond the buffer allocated to store the result. Fixed by incrementing the dst buffer size by 1. As extra safety, switched to strnmov() and added a debug assert to check the length of the input file name. No test case added as the scenario is already covered by the test cases added for bugs in the description. --- mysys/my_lib.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mysys/my_lib.c b/mysys/my_lib.c index c18d14fb549..41dc8f46f8e 100644 --- a/mysys/my_lib.c +++ b/mysys/my_lib.c @@ -103,7 +103,7 @@ MY_DIR *my_dir(const char *path, myf MyFlags) MEM_ROOT *names_storage; DIR *dirp; struct dirent *dp; - char tmp_path[FN_REFLEN+1],*tmp_file; + char tmp_path[FN_REFLEN + 2], *tmp_file; #ifdef THREAD char dirent_tmp[sizeof(struct dirent)+_POSIX_PATH_MAX+1]; #endif @@ -215,10 +215,11 @@ char * directory_file_name (char * dst, const char *src) /* Process as Unix format: just remove test the final slash. */ char * end; + DBUG_ASSERT(strlen(src) < (FN_REFLEN + 1)); if (src[0] == 0) src= (char*) "."; /* Use empty as current */ - end=strmov(dst, src); + end= strnmov(dst, src, FN_REFLEN + 1); if (end[-1] != FN_LIBCHAR) { end[0]=FN_LIBCHAR; /* Add last '/' */ -- cgit v1.2.1