(openoffice) branch AOO41X updated: Fix buffer overflow in DirEntry::TempName() (snprintf/strcat bounds)

[ardovm.apache.org via commits]

This is an automated email from the ASF dual-hosted git repository.

ardovm pushed a commit to branch AOO41X
in repository https://gitbox.apache.org/repos/asf/openoffice.git


The following commit(s) were added to refs/heads/AOO41X by this push:
     new df79dc9a16 Fix buffer overflow in DirEntry::TempName() 
(snprintf/strcat bounds)
df79dc9a16 is described below

commit df79dc9a1663393ea9b682dd46ba2ebafa8eb053
Author: Pedro Giffuni <p...@apache.org>
AuthorDate: Sun Oct 25 21:09:09 2026 -0500

    Fix buffer overflow in DirEntry::TempName() (snprintf/strcat bounds)
    
    Found with:     GCC 15 + FORTIFY_SOURCE
    
    (cherry picked from commit 7d712b94e3ff1803b979fa5f284e7acd2daba990)
---
 main/tools/source/fsys/dirent.cxx | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/main/tools/source/fsys/dirent.cxx 
b/main/tools/source/fsys/dirent.cxx
index 3bcba13a21..5d753dcce1 100644
--- a/main/tools/source/fsys/dirent.cxx
+++ b/main/tools/source/fsys/dirent.cxx
@@ -2146,7 +2146,8 @@ DirEntry DirEntry::TempName( DirEntryKind eKind ) const
         i = strlen(dir);
         // need to add ?\\? + prefix + number + pid + .ext + '\0'
 #       define TMPNAME_SIZE  ( 1 + 5 + 5 + 10 + 4 + 1 )
-        ret_val = new char[i + TMPNAME_SIZE ];
+        size_t nBufSize = i + TMPNAME_SIZE;
+        ret_val = new char[nBufSize];
         if (ret_val)
         {
             strcpy(ret_val,dir);
@@ -2183,7 +2184,7 @@ DirEntry DirEntry::TempName( DirEntryKind eKind ) const
             for ( unsigned long nOld = u; ++u != nOld; ) /* Hae??? */
             {
                 u %= 100000;  /* on *NIX repeats every 100ms, maybe less if 
CLOCKS_PER_SEC > 10^6 */
-                snprintf(ret_val+i, TMPNAME_SIZE, "%05lu%lu", u, mypid);
+                snprintf(ret_val+i, nBufSize - i, "%05lu%lu", u, mypid);
 
                 strcat(ret_val,ext);