Page MenuHomeFreeBSD
Files F163131474

D45086.id138134.diff
No OneTemporary
Actions

D45086.id138134.diff
View Options

diff --git a/libexec/tftpd/tftpd.c b/libexec/tftpd/tftpd.c
--- a/libexec/tftpd/tftpd.c
+++ b/libexec/tftpd/tftpd.c
@@ -609,14 +609,26 @@
* Besides, that is four updates per hour on a file, which is kind of
* execessive anyway.
*/
+/*
+ * Static size of '.' seperators, two digits ("nn"), and nul terminator.
+ * Ultimately, an alternative spelling of "5".
+ */
+#define FILE_SUFFIX_SIZE sizeof("..nn")
static int
find_next_name(char *filename, int *fd)
{
- int i;
+ int i, ret;
time_t tval;
size_t len;
struct tm lt;
- char yyyymmdd[MAXPATHLEN];
+ /*
+ * GCC "knows" that we might write all of yyyymmdd plus the static
+ * elemenents in the format into into newname and thus complains
+ * unless we reduce the size. This array is still too big, but since
+ * the format is user supplied, it's not clear what a better limit
+ * value would be and this is sufficent to silence the warnings.
+ */
+ char yyyymmdd[MAXPATHLEN - FILE_SUFFIX_SIZE];
char newname[MAXPATHLEN];
/* Create the YYYYMMDD part of the filename */
@@ -625,22 +637,30 @@
len = strftime(yyyymmdd, sizeof(yyyymmdd), newfile_format, &lt);
if (len == 0) {
syslog(LOG_WARNING,
- "Filename suffix too long (%d characters maximum)",
- MAXPATHLEN);
+ "Filename suffix too long (%zu characters maximum)",
+ sizeof(yyyymmdd) - 1);
return (EACCESS);
}
/* Make sure the new filename is not too long */
- if (strlen(filename) > MAXPATHLEN - len - 5) {
+ if (strlen(filename) > sizeof(newname) - len - FILE_SUFFIX_SIZE) {
syslog(LOG_WARNING,
- "Filename too long (%zd characters, %zd maximum)",
- strlen(filename), MAXPATHLEN - len - 5);
+ "Filename too long (%zu characters, %zu maximum)",
+ strlen(filename), sizeof(newname) - len - FILE_SUFFIX_SIZE);
return (EACCESS);
}
/* Find the first file which doesn't exist */
for (i = 0; i < 100; i++) {
- sprintf(newname, "%s.%s.%02d", filename, yyyymmdd, i);
+ ret = snprintf(newname, sizeof(newname), "%s.%s.%02d",
+ filename, yyyymmdd, i);
+ /*
+ * Size checked above so this can't happen, we'd use a (void)
+ * cast, but gcc doesn't support that if snprintf is marked
+ * with __attribute__((warn_unused_result)).
+ */
+ if ((size_t)ret >= sizeof(newname))
+ __unreachable();
*fd = open(newname,
O_WRONLY | O_CREAT | O_EXCL,
S_IRUSR | S_IWUSR | S_IRGRP |
@@ -651,6 +671,7 @@
return (EEXIST);
}
+#undef FILE_SUFFIX_SIZE
/*
* Validate file access. Since we

File Metadata

Mime Type
text/plain
Expires
Tue, Jul 21, 9:03 AM (4 h, 50 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35311192
Default Alt Text
D45086.id138134.diff (2 KB)

Event Timeline