[mapserver-commits] r10313 - branches/branch-4-10/mapserver

[svn at osgeo.org]

Author: dmorissette
Date: 2010-07-08 21:07:22 +0000 (Thu, 08 Jul 2010)
New Revision: 10313

Modified:
   branches/branch-4-10/mapserver/maputil.c
Log:
Fixed possible buffer overflow in msTmpFile() (#3484)

Modified: branches/branch-4-10/mapserver/maputil.c
===================================================================
--- branches/branch-4-10/mapserver/maputil.c	2010-07-08 21:06:28 UTC (rev 10312)
+++ branches/branch-4-10/mapserver/maputil.c	2010-07-08 21:07:22 UTC (rev 10313)
@@ -1121,22 +1121,24 @@
     char szPath[MS_MAXPATHLEN];
     const char *fullFname;
     char tmpId[128]; /* big enough for time + pid + ext */
+    const char *tmpBase = NULL;
 
     if( ForcedTmpBase != NULL )
     {
-        strncpy( tmpId, ForcedTmpBase, sizeof(tmpId) );
+        tmpBase = ForcedTmpBase;
     }
     else 
     {
         /* We'll use tmpId and tmpCount to generate unique filenames */
         sprintf(tmpId, "%lx_%x",(long)time(NULL),(int)getpid());
+        tmpBase = tmpId;
     }
 
     if (ext == NULL)  ext = "";
-    tmpFname = (char*)malloc(strlen(tmpId) + 10  + strlen(ext) + 1);
+    tmpFname = (char*)malloc(strlen(tmpBase) + 10  + strlen(ext) + 1);
 
     msAcquireLock( TLOCK_TMPFILE );
-    sprintf(tmpFname, "%s_%x.%s", tmpId, tmpCount++, ext);
+    sprintf(tmpFname, "%s_%x.%s", tmpBase, tmpCount++, ext);
     msReleaseLock( TLOCK_TMPFILE );
 
     fullFname = msBuildPath3(szPath, mappath, tmppath, tmpFname);