nobu	2012-12-01 15:05:33 +0900 (Sat, 01 Dec 2012)

  New Revision: 38105

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=38105

  Log:
    dir.c: use NAMLEN
    
    * dir.c (glob_helper): use NAMLEN() to tell the length of d_name
      instead of strlen(), which can access beyond the boundary.

  Modified files:
    trunk/ChangeLog
    trunk/dir.c

Index: ChangeLog
===================================================================
--- ChangeLog	(revision 38104)
+++ ChangeLog	(revision 38105)
@@ -1,3 +1,8 @@
+Sat Dec  1 15:05:30 2012  Nobuyoshi Nakada  <nobu@r...>
+
+	* dir.c (glob_helper): use NAMLEN() to tell the length of d_name
+	  instead of strlen(), which can access beyond the boundary.
+
 Sat Dec  1 13:48:13 2012  Eric Hodel  <drbrain@s...>
 
 	* lib/rubygems/specification.rb:  Don't add default gems to $LOAD_PATH
Index: dir.c
===================================================================
--- dir.c	(revision 38104)
+++ dir.c	(revision 38105)
@@ -1132,10 +1132,9 @@
 }
 
 /* Remove escaping backslashes */
-static void
-remove_backslashes(char *p, rb_encoding *enc)
+static char *
+remove_backslashes(char *p, register const char *pend, rb_encoding *enc)
 {
-    register const char *pend = p + strlen(p);
     char *t = p;
     char *s = p;
 
@@ -1154,6 +1153,8 @@
 
     if (t != s)
 	memmove(t, s, p - s); /* move '\0' too */
+
+    return p;
 }
 
 /* Globing pattern */
@@ -1247,19 +1248,18 @@
 }
 
 static char *
-join_path(const char *path, int dirsep, const char *name)
+join_path(const char *path, int dirsep, const char *name, size_t namlen)
 {
     long len = strlen(path);
-    long len2 = strlen(name)+(dirsep?1:0)+1;
-    char *buf = GLOB_ALLOC_N(char, len+len2);
+    char *buf = GLOB_ALLOC_N(char, len+namlen+(dirsep?1:0)+1);
 
     if (!buf) return 0;
     memcpy(buf, path, len);
     if (dirsep) {
 	buf[len++] = '/';
     }
-    buf[len] = '\0';
-    strlcat(buf+len, name, len2);
+    memcpy(buf+len, name, namlen);
+    buf[len+namlen] = '\0';
     return buf;
 }
 
@@ -1364,7 +1364,7 @@
 	    if (status) return status;
 	}
 	if (match_dir && isdir == YES) {
-	    char *tmp = join_path(path, dirsep, "");
+	    char *tmp = join_path(path, dirsep, "", 0);
 	    if (!tmp) return -1;
 	    status = glob_call_func(func, tmp, arg, enc);
 	    GLOB_FREE(tmp);
@@ -1394,7 +1394,7 @@
 		if (dp->d_name[1] == '.' && !dp->d_name[2]) continue;
 	    }
 
-	    buf = join_path(path, dirsep, dp->d_name);
+	    buf = join_path(path, dirsep, dp->d_name, NAMLEN(dp));
 	    if (!buf) {
 		status = -1;
 		break;
@@ -1458,7 +1458,8 @@
 		    break;
 		}
 		memcpy(name, (*cur)->str, len);
-		if (escape) remove_backslashes(name, enc);
+		if (escape)
+		    len = remove_backslashes(name, name+len-1, enc) - name;
 
 		new_beg = new_end = GLOB_ALLOC_N(struct glob_pattern *, end - beg);
 		if (!new_beg) {
@@ -1474,7 +1475,7 @@
 		    }
 		}
 
-		buf = join_path(path, dirsep, name);
+		buf = join_path(path, dirsep, name, len);
 		GLOB_FREE(name);
 		if (!buf) {
 		    GLOB_FREE(new_beg);

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/