fix for out of bounds read in BLI_path_rel

1 files changed, 8 insertions, 4 deletions

diff --git a/source/blender/blenlib/intern/path_util.c b/source/blender/blenlib/intern/path_util.c
index fe50c2abcc1..1e76a7f3164 100644
--- a/source/blender/blenlib/intern/path_util.c
+++ b/source/blender/blenlib/intern/path_util.c
@@ -530,6 +530,7 @@ void BLI_path_rel(char *file, const char *relfile)
 		 * This is replaced by the two slashes at the beginning */
 		char *p = temp;
 		char *q = file;
+		char *r = res;
 
 #ifdef WIN32
 		while (tolower(*p) == tolower(*q))
@@ -557,20 +558,23 @@ void BLI_path_rel(char *file, const char *relfile)
 			while ( (p >= temp) && (*p != '/') ) { --p; --q; }
 		}
 		
-		strcpy(res, "//");
+		r += BLI_strcpy_rlen(r, "//");
 
 		/* p now points to the slash that is at the beginning of the part
 		 * where the path is different from the relative path. 
 		 * We count the number of directories we need to go up in the
 		 * hierarchy to arrive at the common 'prefix' of the path
 		 */
+		if (p < temp) p = temp;
 		while (p && p < lslash) {
-			if (*p == '/') 
-				strcat(res, "../");
+			if (*p == '/') {
+				r += BLI_strcpy_rlen(r, "../");
+			}
 			p++;
 		}
 
-		strcat(res, q + 1); /* don't copy the slash at the beginning */
+		/* don't copy the slash at the beginning */
+		r += BLI_strcpy_rlen(r, q + 1);
 		
 #ifdef  WIN32
 		BLI_char_switch(res + 2, '/', '\\');