Commit: 2a72518af753325e524a5fa5884841f4af0998cb
Author: Campbell Barton
Date: Sun Dec 28 15:59:12 2014 +1100
Branches: blender-v2.73-release
https://developer.blender.org/rB2a72518af753325e524a5fa5884841f4af0998cb
Fix buffer overrun calculating unique names
===================================================================
M source/blender/blenlib/intern/path_util.c
===================================================================
diff --git a/source/blender/blenlib/intern/path_util.c
b/source/blender/blenlib/intern/path_util.c
index 0a30a35..8b57018 100644
--- a/source/blender/blenlib/intern/path_util.c
+++ b/source/blender/blenlib/intern/path_util.c
@@ -228,7 +228,8 @@ bool BLI_uniquename_cb(bool (*unique_check)(void *arg,
const char *name),
int number;
int len = BLI_split_name_num(left, &number, name, delim);
do {
- const int numlen = BLI_snprintf(numstr, sizeof(numstr),
"%c%03d", delim, ++number);
+ /* add 1 to account for \0 */
+ const int numlen = BLI_snprintf(numstr, sizeof(numstr),
"%c%03d", delim, ++number) + 1;
/* highly unlikely the string only has enough room for
the number
* but support anyway */
@@ -238,9 +239,8 @@ bool BLI_uniquename_cb(bool (*unique_check)(void *arg,
const char *name),
}
else {
char *tempname_buf;
- tempname[0] = '\0';
- tempname_buf = BLI_strncat_utf8(tempname, left,
name_len - numlen);
- memcpy(tempname_buf, numstr, numlen + 1);
+ tempname_buf = tempname +
BLI_strncpy_utf8_rlen(tempname, left, name_len - numlen);
+ memcpy(tempname_buf, numstr, numlen);
}
} while (unique_check(arg, tempname));
_______________________________________________
Bf-blender-cvs mailing list
[email protected]
http://lists.blender.org/mailman/listinfo/bf-blender-cvs
