Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for buffer being big enough in wxPathOnly().

Browse Source 
Just return NULL or empty string if the input path is too long. This is
probably not ideal but it fixes a buffer overflow and all this code needs to
be rewritten to use wxFileName() anyhow so it's not worth doing anything more
at this moment.

Closes #15302.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@74455 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
This commit is contained in:
Vadim Zeitlin
2013-07-08 21:44:06 +00:00
parent fff5f7d5d8
commit 2e6bfeb903
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/common/filefn.cpp
View File

@@ -743,11 +743,13 @@ wxPathOnly (wxChar *path)
{ {
static wxChar buf[_MAXPATHLEN]; static wxChar buf[_MAXPATHLEN];
// Local copy
wxStrcpy (buf, path);
int l = wxStrlen(path); int l = wxStrlen(path);
int i = l - 1; int i = l - 1;
if ( i >= _MAXPATHLEN )
return NULL;
// Local copy
wxStrcpy (buf, path);
// Search backward for a backward or forward slash // Search backward for a backward or forward slash
while (i > -1) while (i > -1)
@@ -789,12 +791,15 @@ wxString wxPathOnly (const wxString& path)
{ {
wxChar buf[_MAXPATHLEN]; wxChar buf[_MAXPATHLEN];
// Local copy
wxStrcpy(buf, path);
int l = path.length(); int l = path.length();
int i = l - 1; int i = l - 1;
if ( i >= _MAXPATHLEN )
return wxString();
// Local copy
wxStrcpy(buf, path);
// Search backward for a backward or forward slash // Search backward for a backward or forward slash
while (i > -1) while (i > -1)
{ {