Cwd.xs: off-by-one buffer overflow in realpath()
authorCasey West <casey@geeknest.com>
Mon, 3 Nov 2003 10:11:43 +0000 (05:11 -0500)
committerRafael Garcia-Suarez <rgarciasuarez@gmail.com>
Mon, 3 Nov 2003 20:00:07 +0000 (20:00 +0000)
Message-ID: <20031103151143.GB430@geeknest.com>

p4raw-id: //depot/perl@21646

ext/Cwd/Cwd.xs

index 3f7b93b..4600fef 100644 (file)
@@ -166,7 +166,7 @@ loop:
                rootd = 0;
 
        if (*wbuf) {
-               if (strlen(resolved) + strlen(wbuf) + rootd + 1 > MAXPATHLEN) {
+               if (strlen(resolved) + strlen(wbuf) + (1 - rootd) + 1 > MAXPATHLEN) {
                        errno = ENAMETOOLONG;
                        goto err1;
                }