git_mkstemp(): be careful not to overflow the path buffer.
If user's TMPDIR is insanely long, return negative after setting errno to ENAMETOOLONG, pretending that the underlying mkstemp() choked on a temporary file path that is too long. Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
22
path.c
22
path.c
@ -71,21 +71,17 @@ char *git_path(const char *fmt, ...)
|
||||
/* git_mkstemp() - create tmp file honoring TMPDIR variable */
|
||||
int git_mkstemp(char *path, size_t len, const char *template)
|
||||
{
|
||||
char *env, *pch = path;
|
||||
const char *tmp;
|
||||
size_t n;
|
||||
|
||||
if ((env = getenv("TMPDIR")) == NULL) {
|
||||
strcpy(pch, "/tmp/");
|
||||
len -= 5;
|
||||
pch += 5;
|
||||
} else {
|
||||
size_t n = snprintf(pch, len, "%s/", env);
|
||||
|
||||
len -= n;
|
||||
pch += n;
|
||||
tmp = getenv("TMPDIR");
|
||||
if (!tmp)
|
||||
tmp = "/tmp";
|
||||
n = snprintf(path, len, "%s/%s", tmp, template);
|
||||
if (len <= n) {
|
||||
errno = ENAMETOOLONG;
|
||||
return -1;
|
||||
}
|
||||
|
||||
strlcpy(pch, template, len);
|
||||
|
||||
return mkstemp(path);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user