From eba9b4f6c18c1249f353fa752050ced9e9e5f7d1 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Thu, 27 Jun 2013 20:47:59 +0000 Subject: fix for out of bounds read in BLI_path_rel --- source/blender/blenlib/intern/path_util.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'source/blender') diff --git a/source/blender/blenlib/intern/path_util.c b/source/blender/blenlib/intern/path_util.c index fe50c2abcc1..1e76a7f3164 100644 --- a/source/blender/blenlib/intern/path_util.c +++ b/source/blender/blenlib/intern/path_util.c @@ -530,6 +530,7 @@ void BLI_path_rel(char *file, const char *relfile) * This is replaced by the two slashes at the beginning */ char *p = temp; char *q = file; + char *r = res; #ifdef WIN32 while (tolower(*p) == tolower(*q)) @@ -557,20 +558,23 @@ void BLI_path_rel(char *file, const char *relfile) while ( (p >= temp) && (*p != '/') ) { --p; --q; } } - strcpy(res, "//"); + r += BLI_strcpy_rlen(r, "//"); /* p now points to the slash that is at the beginning of the part * where the path is different from the relative path. * We count the number of directories we need to go up in the * hierarchy to arrive at the common 'prefix' of the path */ + if (p < temp) p = temp; while (p && p < lslash) { - if (*p == '/') - strcat(res, "../"); + if (*p == '/') { + r += BLI_strcpy_rlen(r, "../"); + } p++; } - strcat(res, q + 1); /* don't copy the slash at the beginning */ + /* don't copy the slash at the beginning */ + r += BLI_strcpy_rlen(r, q + 1); #ifdef WIN32 BLI_char_switch(res + 2, '/', '\\'); -- cgit v1.2.3