From a44e28cc027424c9c6636ef1772f3f739ec74d90 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Axel=20D=C3=B6rfler?= Date: Wed, 28 Apr 2004 11:20:19 +0000 Subject: [PATCH] Fixed a possible buffer overflow condition in vfs_get_module_path(). git-svn-id: file:///srv/svn/repos/haiku/trunk/current@7342 a95241bf-73f2-0310-859d-f6bbb57e9c96 --- src/kernel/core/fs/vfs.cpp | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/kernel/core/fs/vfs.cpp b/src/kernel/core/fs/vfs.cpp index 9665545e66..a3c194b739 100755 --- a/src/kernel/core/fs/vfs.cpp +++ b/src/kernel/core/fs/vfs.cpp @@ -1386,7 +1386,7 @@ vfs_get_module_path(const char *basePath, const char *moduleName, char *pathBuff size_t length; char *path; - if (strlcpy(pathBuffer, basePath, bufferSize) > bufferSize) + if (bufferSize == 0 || strlcpy(pathBuffer, basePath, bufferSize - 1) > bufferSize - 1) return B_BUFFER_OVERFLOW; status = path_to_vnode(pathBuffer, true, &dir, true); @@ -1395,7 +1395,6 @@ vfs_get_module_path(const char *basePath, const char *moduleName, char *pathBuff length = strlen(pathBuffer); if (pathBuffer[length - 1] != '/') { - // ToDo: bufferSize race condition pathBuffer[length] = '/'; length++; } @@ -1412,7 +1411,7 @@ vfs_get_module_path(const char *basePath, const char *moduleName, char *pathBuff else length = nextPath - moduleName; - if (length + 1>= bufferSize) { + if (length + 1 >= bufferSize) { status = B_BUFFER_OVERFLOW; goto err; }