develooper Front page | perl.perl5.porters | Postings from November 2003

Re: Cwd.xs: off-by-one buffer overflow in realpath()

Thread Previous | Thread Next
From:
Rafael Garcia-Suarez
Date:
November 3, 2003 13:18
Subject:
Re: Cwd.xs: off-by-one buffer overflow in realpath()
Message ID:
20031103222411.15187f48.rgarciasuarez@free.fr
Casey West wrote:
> ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:08.realpath.asc 

Thanks, applied as #21646 to blead. (by hand, for some reason.)

> --- perl-current-orig/ext/Cwd/Cwd.xs    Thu May 16 18:16:19 2002
> +++ perl-current/ext/Cwd/Cwd.xs Thu Oct 30 12:08:12 2003
> @@ -166,7 +166,7 @@
>                 rootd = 0;
>  
>         if (*wbuf) {
> -               if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) {
> +               if (strlen(resolved) + strlen(wbuf) + (1-rootd) + 1 > MAXPATHLEN) {
Thread Previous | Thread Next

nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About