kwo pushed a commit to branch master. http://git.enlightenment.org/legacy/imlib2.git/commit/?id=81fefc5785e1d91c12406b394d4c77b8abed643c
commit 81fefc5785e1d91c12406b394d4c77b8abed643c Author: Quentin Rameau <[email protected]> Date: Tue Feb 9 16:11:55 2016 +0100 Fix zlib loader filename check Do not impose an arbitrary small buffer size limit on filenames when checking and trimming gz extension. --- src/modules/loaders/loader_zlib.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/src/modules/loaders/loader_zlib.c b/src/modules/loaders/loader_zlib.c index ed448bb..9b03f8f 100644 --- a/src/modules/loaders/loader_zlib.c +++ b/src/modules/loaders/loader_zlib.c @@ -44,8 +44,8 @@ load(ImlibImage * im, ImlibProgressFunction progress, { ImlibLoader *loader; int src, dest, res; - char *file, *p, tmp[] = "/tmp/imlib2_loader_zlib-XXXXXX"; - char real_ext[16]; + char *file, *p, *q, tmp[] = "/tmp/imlib2_loader_zlib-XXXXXX"; + char *real_ext; struct stat st; assert(im); @@ -54,19 +54,8 @@ load(ImlibImage * im, ImlibProgressFunction progress, * (e.g. "foo.png.gz" */ p = strrchr(im->real_file, '.'); - if (p && p != im->real_file) - { - if (strcasecmp(p + 1, "gz")) - return 0; - } - else - return 0; - - strncpy(real_ext, p - sizeof(real_ext) + 1, sizeof(real_ext)); - real_ext[sizeof(real_ext) - 1] = '\0'; - - /* abort if there's no dot in the "real" filename */ - if (!strrchr(real_ext, '.')) + q = strchr(im->real_file, '.'); + if (!p || p == im->real_file || strcasecmp(p + 1, "gz") || p == q) return 0; if (stat(im->real_file, &st) < 0) @@ -93,8 +82,12 @@ load(ImlibImage * im, ImlibProgressFunction progress, return 0; } + if (!(real_ext = strndup(im->real_file, p - im->real_file))) + return 0; + if (!(loader = __imlib_FindBestLoaderForFile(real_ext, 0))) { + free(real_ext); unlink(tmp); return 0; } @@ -108,6 +101,7 @@ load(ImlibImage * im, ImlibProgressFunction progress, free(im->real_file); im->real_file = file; + free(real_ext); unlink(tmp); return 1; --
