Skip to content

Commit 72f611a

Browse files
committed
Add a terminating null byte to the buffer
Also, add error handling if the buffer is too small. When copying a link, the buffer used to call readlink() is not null-terminated after the call, resulting in a target name with random buffer data appended to it and thus in a dangling link.
1 parent c630b14 commit 72f611a

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

src/vfs/vfs-file-task.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,16 @@ vfs_file_task_do_copy( VFSFileTask* task,
260260
{
261261
if ( ( rfd = readlink( src_file, buffer, sizeof( buffer ) ) ) > 0 )
262262
{
263+
if ( rfd < sizeof( buffer ) )
264+
buffer[rfd] = 0;
265+
else
266+
{
267+
task->error = ENAMETOOLONG;
268+
call_state_callback( task, VFS_FILE_TASK_ERROR );
269+
if ( should_abort( task ) )
270+
goto _return_;
271+
}
272+
263273
if ( ! check_overwrite( task, dest_file,
264274
&dest_exists, &new_dest_file ) )
265275
goto _return_;

0 commit comments

Comments
 (0)