[mapserver-commits] r10313 - branches/branch-4-10/mapserver
svn at osgeo.org
svn at osgeo.org
Thu Jul 8 17:07:22 EDT 2010
Author: dmorissette
Date: 2010-07-08 21:07:22 +0000 (Thu, 08 Jul 2010)
New Revision: 10313
Modified:
branches/branch-4-10/mapserver/maputil.c
Log:
Fixed possible buffer overflow in msTmpFile() (#3484)
Modified: branches/branch-4-10/mapserver/maputil.c
===================================================================
--- branches/branch-4-10/mapserver/maputil.c 2010-07-08 21:06:28 UTC (rev 10312)
+++ branches/branch-4-10/mapserver/maputil.c 2010-07-08 21:07:22 UTC (rev 10313)
@@ -1121,22 +1121,24 @@
char szPath[MS_MAXPATHLEN];
const char *fullFname;
char tmpId[128]; /* big enough for time + pid + ext */
+ const char *tmpBase = NULL;
if( ForcedTmpBase != NULL )
{
- strncpy( tmpId, ForcedTmpBase, sizeof(tmpId) );
+ tmpBase = ForcedTmpBase;
}
else
{
/* We'll use tmpId and tmpCount to generate unique filenames */
sprintf(tmpId, "%lx_%x",(long)time(NULL),(int)getpid());
+ tmpBase = tmpId;
}
if (ext == NULL) ext = "";
- tmpFname = (char*)malloc(strlen(tmpId) + 10 + strlen(ext) + 1);
+ tmpFname = (char*)malloc(strlen(tmpBase) + 10 + strlen(ext) + 1);
msAcquireLock( TLOCK_TMPFILE );
- sprintf(tmpFname, "%s_%x.%s", tmpId, tmpCount++, ext);
+ sprintf(tmpFname, "%s_%x.%s", tmpBase, tmpCount++, ext);
msReleaseLock( TLOCK_TMPFILE );
fullFname = msBuildPath3(szPath, mappath, tmppath, tmpFname);
More information about the mapserver-commits
mailing list