[AC 21.5] Fix off-by-one error in file-truename
Jerry James <[email protected]> Fri, 5 Dec 2014 16:55:49 -0700
| Newsgroups | gmane.emacs.xemacs.patches |
|---|---|
| Message-ID | <CAHCOHQnOwYH5kF0mq6184Fetuus-KOeKNUpTHYXhq56AvcuE9A@mail.gmail.com> |
APPROVE COMMIT 21.5 This is another obviously correct fix. The problem was found by Coverity Scan. Near the end of file-truename, we make sure that rlen is a valid array index before inserting a directory separator and a null terminator. However, we need to make sure that rlen + 1 is a valid array index, since that is where the null terminator goes. I will commit and push this shortly. diff -r 7984e732829e src/ChangeLog --- a/src/ChangeLog Fri Dec 05 16:22:57 2014 -0700 +++ b/src/ChangeLog Fri Dec 05 16:45:24 2014 -0700 @@ -1,3 +1,7 @@ +2014-12-05 Jerry James <[email protected]> + + * src/fileio.c (Ffile_truename): Fix off-by-one error. + 2014-11-23 Michael Sperber <[email protected]> * font-mgr.c (Ffc_name_unparse): Do the previous change to this diff -r 7984e732829e src/fileio.c --- a/src/fileio.c Fri Dec 05 16:22:57 2014 -0700 +++ b/src/fileio.c Fri Dec 05 16:45:24 2014 -0700 @@ -1466,7 +1466,7 @@ if (elen > 0 && IS_DIRECTORY_SEP (string_byte (expanded_name, elen - 1)) && !(rlen > 0 && IS_DIRECTORY_SEP (resolved_path[rlen - 1]))) { - if (rlen + 1 > countof (resolved_path)) + if (rlen + 1 >= countof (resolved_path)) goto toolong; resolved_path[rlen++] = DIRECTORY_SEP; resolved_path[rlen] = '\0'; -- Jerry James http://www.jamezone.org/