Bug #51893: crash with certain characters given to load_file

  function on windows

When making sure that the directory path ends up with a 
slash/backslash we need to check for the correct length of 
the buffer and trim at the appropriate location so we don't
write past the end of the buffer.

1 files changed, 3 insertions, 0 deletions

diff --git a/mysys/mf_pack.c b/mysys/mf_pack.c
index c13a5581b80..4f7cd90e8aa 100644
--- a/mysys/mf_pack.c
+++ b/mysys/mf_pack.c
@@ -311,6 +311,9 @@ size_t normalize_dirname(char *to, const char *from)
 #endif
       buff[length - 1] != FN_LIBCHAR && buff[length - 1] != '/')
   {
+    /* we need reserve 2 bytes for the trailing slash and the zero */
+    if (length >= sizeof (buff) - 1)
+      length= sizeof (buff) - 2;
     buff[length]= FN_LIBCHAR;
     buff[length + 1]= '\0';
   }