From edae1c72008cdd59f3ae3ed2a9172dc74e87e1b6 Mon Sep 17 00:00:00 2001 From: nobu Date: Mon, 29 Sep 2014 13:54:50 +0000 Subject: win32/file.c: fix no user exception * win32/file.c (append_wstr): set expanded length, not length of appended string. fix "probable buffer overflow" bug. [ruby-core:65317] [Bug #10304] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@47738 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- win32/file.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'win32') diff --git a/win32/file.c b/win32/file.c index 99c35217e1..fc10ca0068 100644 --- a/win32/file.c +++ b/win32/file.c @@ -272,14 +272,14 @@ replace_to_long_name(wchar_t **wfullpath, size_t size, int heap) } static inline size_t -user_length_in_path(const wchar_t *wuser) +user_length_in_path(const wchar_t *wuser, size_t len) { - const wchar_t *pos = wuser; + size_t i; - while (!IS_DIR_SEPARATOR_P(*pos) && *pos != '\0') - pos++; + for (i = 0; i < len && !IS_DIR_SEPARATOR_P(wuser[i]); i++) + ; - return pos - wuser; + return i; } static VALUE @@ -293,7 +293,7 @@ append_wstr(VALUE dst, const wchar_t *ws, size_t len, UINT cp, UINT path_cp, rb_ rb_str_modify_expand(dst, nlen); WideCharToMultiByte(cp, 0, ws, len, RSTRING_PTR(dst) + olen, nlen, NULL, NULL); rb_enc_associate(dst, path_encoding); - rb_str_set_len(dst, nlen); + rb_str_set_len(dst, olen + nlen); } else { const int replaceflags = ECONV_UNDEF_REPLACE|ECONV_INVALID_REPLACE; @@ -402,7 +402,7 @@ rb_file_expand_path_internal(VALUE fname, VALUE dname, int abs_mode, int long_na } else if (abs_mode == 0 && wpath_len >= 2 && wpath_pos[0] == L'~') { result = rb_str_new_cstr("can't find user "); - result = append_wstr(result, wpath_pos + 1, user_length_in_path(wpath_pos + 1), + result = append_wstr(result, wpath_pos + 1, user_length_in_path(wpath_pos + 1, wpath_len - 1), cp, path_cp, path_encoding); if (wpath) @@ -478,7 +478,7 @@ rb_file_expand_path_internal(VALUE fname, VALUE dname, int abs_mode, int long_na } else if (abs_mode == 0 && wdir_len >= 2 && wdir_pos[0] == L'~') { result = rb_str_new_cstr("can't find user "); - result = append_wstr(result, wdir_pos + 1, user_length_in_path(wdir_pos + 1), + result = append_wstr(result, wdir_pos + 1, user_length_in_path(wdir_pos + 1, wdir_len - 1), cp, path_cp, path_encoding); if (wpath) free(wpath); -- cgit v1.2.3