-
Notifications
You must be signed in to change notification settings - Fork 22
Open
Description
sfm.c lines 332 to 335
if (first[0] == '/' && first[1] == '\0')
(void)snprintf(full_path, PATH_MAX, "/%s", second);
ret = snprintf(full_path, PATH_MAX, "%s/%s", first, second);
If variable first is string "/" then the result of first special case snprintf , which is placed in the buffer full_path, will be over-written by the second snprintf, so in that case the first snprintf will have no effect, so if first is "/" the full_path will start with "//" which presumably the code was meant to be avoided. Also the result of the first snprintf is not checked (I overlooked that in my first raising of this issue).
May I suggest
if (first[0] == '/' && first[1] == '\0')
ret = snprintf(full_path, PATH_MAX, "/%s", second);
else
ret = snprintf(full_path, PATH_MAX, "%s/%s", first, second);
Then both snprintf will produce a ret value and drop through to the subsequent validation of the ret value.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels