[mapserver-commits] r9043 - branches/branch-5-4/mapserver

[svn at osgeo.org]

Author: sdlime
Date: 2009-05-28 00:16:04 -0400 (Thu, 28 May 2009)
New Revision: 9043

Modified:
   branches/branch-5-4/mapserver/mapraster.c
Log:
Fixed potential buffer overflow with raster tile filenames. (#3028)

Modified: branches/branch-5-4/mapserver/mapraster.c
===================================================================
--- branches/branch-5-4/mapserver/mapraster.c	2009-05-27 21:51:22 UTC (rev 9042)
+++ branches/branch-5-4/mapserver/mapraster.c	2009-05-28 04:16:04 UTC (rev 9043)
@@ -1398,10 +1398,12 @@
 
       if(status == MS_DONE) break; /* no more tiles/images */
        
-      if(layer->data == NULL || strlen(layer->data) == 0 ) /* assume whole filename is in attribute field */
-          strcpy( tilename, tshp.values[tileitemindex] );
-      else
-          sprintf(tilename, "%s/%s", tshp.values[tileitemindex], layer->data);
+      if(layer->data == NULL || strlen(layer->data) == 0 ) { /* assume whole filename is in attribute field */
+	(void) strncpy(tilename, tshp.values[tileitemindex], sizeof(tilename)-1);
+	tilename[sizeof(tilename)-1] = '\0';
+      } else {
+	snprintf(tilename, sizeof(tilename), "%s/%s", tshp.values[tileitemindex], layer->data);
+      }
       filename = tilename;
       
       msFreeShape(&tshp); /* done with the shape */