[AC 21.5] Fix off-by-one error in file-truename

Jerry James <[email protected]> Fri, 5 Dec 2014 16:55:49 -0700
Newsgroups gmane.emacs.xemacs.patches
Message-ID <CAHCOHQnOwYH5kF0mq6184Fetuus-KOeKNUpTHYXhq56AvcuE9A@mail.gmail.com>
APPROVE COMMIT 21.5

This is another obviously correct fix.  The problem was found by
Coverity Scan.  Near the end of file-truename, we make sure that rlen
is a valid array index before inserting a directory separator and a
null terminator.  However, we need to make sure that rlen + 1 is a
valid array index, since that is where the null terminator goes.

I will commit and push this shortly.

diff -r 7984e732829e src/ChangeLog
--- a/src/ChangeLog Fri Dec 05 16:22:57 2014 -0700
+++ b/src/ChangeLog Fri Dec 05 16:45:24 2014 -0700
@@ -1,3 +1,7 @@
+2014-12-05  Jerry James  <[email protected]>
+
+ * src/fileio.c (Ffile_truename): Fix off-by-one error.
+
 2014-11-23  Michael Sperber  <[email protected]>

  * font-mgr.c (Ffc_name_unparse): Do the previous change to this
diff -r 7984e732829e src/fileio.c
--- a/src/fileio.c Fri Dec 05 16:22:57 2014 -0700
+++ b/src/fileio.c Fri Dec 05 16:45:24 2014 -0700
@@ -1466,7 +1466,7 @@
       if (elen > 0 && IS_DIRECTORY_SEP (string_byte (expanded_name, elen - 1))
           && !(rlen > 0 && IS_DIRECTORY_SEP (resolved_path[rlen - 1])))
  {
-  if (rlen + 1 > countof (resolved_path))
+  if (rlen + 1 >= countof (resolved_path))
     goto toolong;
   resolved_path[rlen++] = DIRECTORY_SEP;
   resolved_path[rlen] = '\0';

-- 
Jerry James
http://www.jamezone.org/