tiny_libmaker: strip leading directory to avoid buffer overrun

The arhdr.ar_name has 16 bytes. Long object names esp. with leading directory were causing a buffer overrun which was detected by glibc.

grischka committed 15 years ago

Commit 69fe7581 parent 21c2a681 file · +13 −3Browse files

Unified · Split

@@ -78,6 +78,7 @@ int main(int argc, char **argv) · 77 unmodified lines
78	int *afpos = NULL;	78	int *afpos = NULL;
79	int istrlen, strpos = 0, fpos = 0, funccnt = 0, funcmax, hofs;	79	int istrlen, strpos = 0, fpos = 0, funccnt = 0, funcmax, hofs;
80	char afile[260], tfile[260], stmp[20];	80	char afile[260], tfile[260], stmp[20];
		81	char file, name;
81		82
82		83
83	strcpy(afile, "ar_test.a");	84	strcpy(afile, "ar_test.a");
@@ -197,9 +198,18 @@ int main(int argc, char **argv) · 113 unmodified lines
197	}	198	}
198	}	199	}
199	}	200	}
200	memset(&arhdro.ar_name, ' ', sizeof(arhdr.ar_name));	201
201	strcpy(arhdro.ar_name, argv[iarg]);	202	file = argv[iarg];
202	arhdro.ar_name[strlen(argv[iarg])] = '/';	203	for (name = strchr(file, 0);
		204	name > file && name[-1] != '/' && name[-1] != '\\';
		205	--name);
		206	istrlen = strlen(name);
		207	if (istrlen >= sizeof(arhdro.ar_name))
		208	istrlen = sizeof(arhdro.ar_name) - 1;
		209	memset(arhdro.ar_name, ' ', sizeof(arhdro.ar_name));
		210	memcpy(arhdro.ar_name, name, istrlen);
		211	arhdro.ar_name[istrlen] = '/';
		212
203	sprintf(stmp, "%-10d", fsize);	213	sprintf(stmp, "%-10d", fsize);
204	memcpy(&arhdro.ar_size, stmp, 10);	214	memcpy(&arhdro.ar_size, stmp, 10);
205	fwrite(&arhdro, sizeof(arhdro), 1, fo);	215	fwrite(&arhdro, sizeof(arhdro), 1, fo);

Keyboard shortcuts