[mapserver-commits] r10305 - branches/branch-5-6/mapserver

[svn at osgeo.org]

Author: dmorissette
Date: 2010-07-08 20:04:54 +0000 (Thu, 08 Jul 2010)
New Revision: 10305

Modified:
   branches/branch-5-6/mapserver/maputil.c
Log:
Fixed possible buffer overflow in msTmpFile() (#3484)

Modified: branches/branch-5-6/mapserver/maputil.c
===================================================================
--- branches/branch-5-6/mapserver/maputil.c	2010-07-08 15:07:36 UTC (rev 10304)
+++ branches/branch-5-6/mapserver/maputil.c	2010-07-08 20:04:54 UTC (rev 10305)
@@ -1347,22 +1347,24 @@
     char szPath[MS_MAXPATHLEN];
     const char *fullFname;
     char tmpId[128]; /* big enough for time + pid + ext */
+    const char *tmpBase = NULL;
 
     if( ForcedTmpBase != NULL )
     {
-        strncpy( tmpId, ForcedTmpBase, sizeof(tmpId) );
+        tmpBase = ForcedTmpBase;
     }
     else 
     {
         /* We'll use tmpId and tmpCount to generate unique filenames */
         sprintf(tmpId, "%lx_%x",(long)time(NULL),(int)getpid());
+        tmpBase = tmpId;
     }
 
     if (ext == NULL)  ext = "";
-    tmpFname = (char*)malloc(strlen(tmpId) + 10  + strlen(ext) + 1);
+    tmpFname = (char*)malloc(strlen(tmpBase) + 10  + strlen(ext) + 1);
 
     msAcquireLock( TLOCK_TMPFILE );
-    sprintf(tmpFname, "%s_%x.%s", tmpId, tmpCount++, ext);
+    sprintf(tmpFname, "%s_%x.%s", tmpBase, tmpCount++, ext);
     msReleaseLock( TLOCK_TMPFILE );
 
     fullFname = msBuildPath3(szPath, mappath, tmppath, tmpFname);