Revision: 40950
http://projects.blender.org/scm/viewvc.php?view=rev&root=bf-blender&revision=40950
Author: campbellbarton
Date: 2011-10-12 11:18:46 +0000 (Wed, 12 Oct 2011)
Log Message:
-----------
fix for possible buffer overflow bug in BLI_join_dirfile(), recent fix didn't
account for the case when destination string and dir string matched.
Modified Paths:
--------------
trunk/blender/source/blender/blenlib/intern/path_util.c
Modified: trunk/blender/source/blender/blenlib/intern/path_util.c
===================================================================
--- trunk/blender/source/blender/blenlib/intern/path_util.c 2011-10-12
06:11:21 UTC (rev 40949)
+++ trunk/blender/source/blender/blenlib/intern/path_util.c 2011-10-12
11:18:46 UTC (rev 40950)
@@ -1430,21 +1430,40 @@
}
/* simple appending of filename to dir, does not check for valid path! */
-void BLI_join_dirfile(char *string, const size_t maxlen, const char *dir,
const char *file)
+void BLI_join_dirfile(char *dst, const size_t maxlen, const char *dir, const
char *file)
{
- int sl_dir;
+ size_t dirlen= BLI_strnlen(dir, maxlen);
- if(string != dir) /* compare pointers */
- BLI_strncpy(string, dir, maxlen -(file ? 1 : 0));
+ if (dst != dir) {
+ if(dirlen == maxlen) {
+ memcpy(dst, dir, dirlen);
+ dst[dirlen - 1]= '\0';
+ return; /* dir fills the path */
+ }
+ else {
+ memcpy(dst, dir, dirlen + 1);
+ }
+ }
- if (!file)
+ if (dirlen + 1 >= maxlen) {
+ return; /* fills the path */
+ }
+
+ /* inline BLI_add_slash */
+ if (dst[dirlen - 1] != SEP) {
+ dst[dirlen++]= SEP;
+ dst[dirlen ]= '\0';
+ }
+
+ if (dirlen >= maxlen) {
+ return; /* fills the path */
+ }
+
+ if (file == NULL) {
return;
+ }
- sl_dir= BLI_add_slash(string);
-
- if (sl_dir < maxlen) {
- BLI_strncpy(string + sl_dir, file, maxlen - sl_dir);
- }
+ BLI_strncpy(dst + dirlen, file, maxlen - dirlen);
}
/* like pythons os.path.basename( ) */
_______________________________________________
Bf-blender-cvs mailing list
[email protected]
http://lists.blender.org/mailman/listinfo/bf-blender-cvs
