The arhdr.ar_name has 16 bytes. Long object names esp. with leading directory were causing a buffer overrun which was detected by glibc.
Unified · Split
| @@ -78,6 +78,7 @@ int main(int argc, char **argv) · 77 unmodified lines | ||
| 78 | 78 | int *afpos = NULL; |
| 79 | 79 | int istrlen, strpos = 0, fpos = 0, funccnt = 0, funcmax, hofs; |
| 80 | 80 | char afile[260], tfile[260], stmp[20]; |
| 81 | + char *file, *name; | |
| 81 | 82 | |
| 82 | 83 | |
| 83 | 84 | strcpy(afile, "ar_test.a"); |
| @@ -197,9 +198,18 @@ int main(int argc, char **argv) · 113 unmodified lines | ||
| 197 | 198 | } |
| 198 | 199 | } |
| 199 | 200 | } |
| 200 | − memset(&arhdro.ar_name, ' ', sizeof(arhdr.ar_name)); | |
| 201 | − strcpy(arhdro.ar_name, argv[iarg]); | |
| 202 | − arhdro.ar_name[strlen(argv[iarg])] = '/'; | |
| 201 | + | |
| 202 | + file = argv[iarg]; | |
| 203 | + for (name = strchr(file, 0); | |
| 204 | + name > file && name[-1] != '/' && name[-1] != '\\'; | |
| 205 | + --name); | |
| 206 | + istrlen = strlen(name); | |
| 207 | + if (istrlen >= sizeof(arhdro.ar_name)) | |
| 208 | + istrlen = sizeof(arhdro.ar_name) - 1; | |
| 209 | + memset(arhdro.ar_name, ' ', sizeof(arhdro.ar_name)); | |
| 210 | + memcpy(arhdro.ar_name, name, istrlen); | |
| 211 | + arhdro.ar_name[istrlen] = '/'; | |
| 212 | + | |
| 203 | 213 | sprintf(stmp, "%-10d", fsize); |
| 204 | 214 | memcpy(&arhdro.ar_size, stmp, 10); |
| 205 | 215 | fwrite(&arhdro, sizeof(arhdro), 1, fo); |