From 3a905214895b6e1270d582a87cf88874deadf6ff Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Thu, 25 Oct 2018 10:27:40 +0900 Subject: [PATCH] mcexec: fix strncat bounding strncat must not look at the appendee's length, but at how much is left where we're appending. This API is stupid anyway, where is strlcat when we need it... Change-Id: Icdf418083146420a06f8ba5ffdf882982610d39b --- executer/user/mcexec.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/executer/user/mcexec.c b/executer/user/mcexec.c index 14f872aa..181a4685 100644 --- a/executer/user/mcexec.c +++ b/executer/user/mcexec.c @@ -3311,8 +3311,10 @@ int main_loop(struct thread_data_s *my_thread) 0); break; } - strncat(pathbuf, "/", 1); - strncat(pathbuf, tmpbuf, strlen(tmpbuf) + 1); + strncat(pathbuf, "/", + sizeof(pathbuf) - strlen(pathbuf) - 1); + strncat(pathbuf, tmpbuf, + sizeof(pathbuf) - strlen(pathbuf) - 1); } else { }