From: Jim Meyering <jim@meyering.net>
Date: Fri, 2 May 2003 21:42:51 +0000 (+0000)
Subject: (canonicalize_file_name) [!HAVE_RESOLVEPATH]:
X-Git-Tag: v5.0.1~613
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=35cad8ae0571cd1318d8281d9954ac60ee32759b;p=thirdparty%2Fcoreutils.git

(canonicalize_file_name) [!HAVE_RESOLVEPATH]:
A memory-allocation error could result in heap corruption.  Fix it
by also updating `dest' when rpath may be changed by xrealloc.
---

diff --git a/lib/canonicalize.c b/lib/canonicalize.c
index 453279d3ca..6e58b282dd 100644
--- a/lib/canonicalize.c
+++ b/lib/canonicalize.c
@@ -173,9 +173,11 @@ canonicalize_file_name (const char *name)
       if (!rpath)
 	return NULL;
       dest = strchr (rpath, '\0');
-      if (dest < rpath + PATH_MAX)
+      if (dest - rpath < PATH_MAX)
 	{
-	  rpath = xrealloc (rpath, PATH_MAX);
+	  char *p = xrealloc (rpath, PATH_MAX);
+	  dest = p + (dest - rpath);
+	  rpath = p;
 	  rpath_limit = rpath + PATH_MAX;
 	}
       else