usa	2016-12-21 16:50:14 +0900 (Wed, 21 Dec 2016)

  New Revision: 57135

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=57135

  Log:
    Fixed potentially buffer overrun.
    
    * win32/win32.c (winnt_stat): the return value of `get_final_path` is the
      expected buffer length, not the actuall filled length.
    
    * win32/win32.c (winnt_stat): `finalname` may be accessed in the outer block of
      its definition via `path`.

  Modified files:
    trunk/win32/win32.c
Index: win32/win32.c
===================================================================
--- win32/win32.c	(revision 57134)
+++ win32/win32.c	(revision 57135)
@@ -5547,11 +5547,11 @@ static int https://github.com/ruby/ruby/blob/trunk/win32/win32.c#L5547
 winnt_stat(const WCHAR *path, struct stati64 *st)
 {
     HANDLE f;
+    WCHAR finalname[PATH_MAX];
 
     memset(st, 0, sizeof(*st));
     f = open_special(path, 0, 0);
     if (f != INVALID_HANDLE_VALUE) {
-	WCHAR finalname[PATH_MAX];
 	const DWORD attr = stati64_handle(f, st);
 	const DWORD len = get_final_path(f, finalname, numberof(finalname), 0);
 	CloseHandle(f);
@@ -5560,7 +5560,7 @@ winnt_stat(const WCHAR *path, struct sta https://github.com/ruby/ruby/blob/trunk/win32/win32.c#L5560
 	}
 	st->st_mode = fileattr_to_unixmode(attr, path);
 	if (len) {
-	    finalname[len] = L'\0';
+	    finalname[min(len, PATH_MAX-1)] = L'\0';
 	    path = finalname;
 	    if (wcsncmp(path, namespace_prefix, numberof(namespace_prefix)) == 0)
 		path += numberof(namespace_prefix);

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/