diff options
| author | Alexander Ewering <blender@instinctive.de> | 2006-05-17 14:09:20 +0400 |
|---|---|---|
| committer | Alexander Ewering <blender@instinctive.de> | 2006-05-17 14:09:20 +0400 |
| commit | 3417378a3a3d2837fb3b721cd778734c145c01cd (patch) | |
| tree | fbcb441909929e4a54a087ada17cef21e0bdb891 /source/blender/python/api2_2x/Sys.c | |
| parent | fc6597fdcff430ba4251c9b22fa6d79f2d659d23 (diff) | |
Fix a buffer overflow in Blender.sys.splitext. It was checking for bounds
(although it did this one char too 'friendly'), but still happily copying
the string even if it was too long.
Pythoneerz, please check if this is the correct fix :)
Diffstat (limited to 'source/blender/python/api2_2x/Sys.c')
| -rw-r--r-- | source/blender/python/api2_2x/Sys.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/source/blender/python/api2_2x/Sys.c b/source/blender/python/api2_2x/Sys.c index bf676b31be1..ac788500841 100644 --- a/source/blender/python/api2_2x/Sys.c +++ b/source/blender/python/api2_2x/Sys.c @@ -300,8 +300,9 @@ static PyObject *M_sys_splitext( PyObject * self, PyObject * args ) /* loong extensions are supported -- foolish, but Python's os.path.splitext * supports them, so ... */ - if( n > FILE_MAXFILE || ( len - n ) > FILE_MAXFILE ) - EXPP_ReturnPyObjError( PyExc_RuntimeError, "path too long" ); + + if( n >= FILE_MAXFILE || ( len - n ) >= FILE_MAXFILE ) + return EXPP_ReturnPyObjError( PyExc_RuntimeError, "path too long" ); BLI_strncpy( ext, dot, n + 1 ); BLI_strncpy( path, name, dot - name + 1 ); |