+2020-09-10 Paul Eggert <eggert@cs.ucla.edu>
+
+ canonicalize: fix pointer indexing bugs
+ Problem reported by Florian Weimer in:
+ https://lists.gnu.org/r/bug-gnulib/2020-09/msg00025.html
+ * lib/canonicalize-lgpl.c (__realpath):
+ * lib/canonicalize.c (canonicalize_filename_mode):
+ Do not generate a pointer past the end of the array.
+ * lib/canonicalize.c (canonicalize_filename_mode):
+ Do not use a pointer after passing it to realloc.
+
2020-09-09 Paul Eggert <eggert@cs.ucla.edu>
tempname: help merge with glibc
rname = xgetcwd ();
if (!rname)
return NULL;
- dest = strchr (rname, '\0');
- if (dest - rname < PATH_MAX)
+ size_t rnamelen = strlen (rname);
+ size_t rnamesize = rnamelen; /* Lower bound on size; good enough. */
+ if (rnamesize < PATH_MAX)
{
- char *p = xrealloc (rname, PATH_MAX);
- dest = p + (dest - rname);
- rname = p;
- rname_limit = rname + PATH_MAX;
- }
- else
- {
- rname_limit = dest;
+ rnamesize = PATH_MAX;
+ rname = xrealloc (rname, rnamesize);
}
+ dest = rname + rnamelen;
+ rname_limit = rname + rnamesize;
start = name;
prefix_len = FILE_SYSTEM_PREFIX_LEN (rname);
}
if (!ISSLASH (dest[-1]))
*dest++ = '/';
- if (dest + (end - start) >= rname_limit)
+ if (rname_limit - dest <= end - start)
{
ptrdiff_t dest_offset = dest - rname;
size_t new_size = rname_limit - rname;