Bug #51893: crash with certain characters given to load_file

 function on windows
               
When making sure that the directory path ends up with a 
slash/backslash we need to check for the correct length of 
the buffer and trim at the appropriate location so we don't
write past the end of the buffer.

1 files changed, 3 insertions, 0 deletions

diff --git a/mysys/mf_pack.c b/mysys/mf_pack.c
index 3053699f457..df206f7e235 100644
--- a/mysys/mf_pack.c
+++ b/mysys/mf_pack.c
@@ -300,6 +300,9 @@ uint normalize_dirname(char *to, const char *from)
 #endif
       buff[length - 1] != FN_LIBCHAR && buff[length - 1] != '/')
   {
+    /* we need reserve 2 bytes for the trailing slash and the zero */
+    if (length >= sizeof (buff) - 1)
+      length= sizeof (buff) - 2;
     buff[length]= FN_LIBCHAR;
     buff[length + 1]= '\0';
   }