From b9380f0e76b34af223c4ef0b4fe648ddca47a59c Mon Sep 17 00:00:00 2001 From: Davi Arnaut Date: Thu, 17 Dec 2009 15:58:38 -0200 Subject: Bug#48983: Bad strmake calls (length one too long) The problem is a somewhat common misusage of the strmake function. The strmake(dst, src, len) function writes at most /len/ bytes to the string pointed to by src, not including the trailing null byte. Hence, if /len/ is the exact length of the destination buffer, a one byte buffer overflow can occur if the length of the source string is equal to or greater than /len/. --- mysys/default.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'mysys/default.c') diff --git a/mysys/default.c b/mysys/default.c index 362aa0d4605..0d162dc13d5 100644 --- a/mysys/default.c +++ b/mysys/default.c @@ -605,7 +605,7 @@ static int search_default_file_with_ext(Process_option_func opt_handler, int recursion_level) { char name[FN_REFLEN + 10], buff[4096], curr_gr[4096], *ptr, *end, **tmp_ext; - char *value, option[4096], tmp[FN_REFLEN]; + char *value, option[4096+2], tmp[FN_REFLEN]; static const char includedir_keyword[]= "includedir"; static const char include_keyword[]= "include"; const int max_recursion_level= 10; -- cgit v1.2.1